Palo Dual Action on Same Malicious Domain

[Joshan_Lakhani]

We have found in the logs, Malicious DNS queries are being blocked but few of them are in Alert State. however the Domain is marked as a malicious in DNS signature at Threat Vault.

Can you please elaborate why paloalto having dual action on same malicious domain.

[reaper]

do you happen to have multiple vsys or could these 'alert' ones be hitting a different rule altogether ?

[Joshan_Lakhani]

@reaper we are not using Vsys moreover it's  hit on same policy. Furthermore when we check the other domains we are still see that some time paloalto it's show alert and 90% is sinkhole please suggest. 

[Joshan_Lakhani]

@reaper @BPry @MP 

In our case, if the get the IP address of the malicious domain and it generates the “alert” on the firewall.

One the second time it will identify its malicious domain then the query will send to the sinkhole.

DNS sinkhole can be used to identify infected hosts on a network where there is an internal DNS Server in-route to the firewall that causes the reference of the original source IP address of the host that first originated the query to be lost (the query is received by the Internal DNS Server, and the internal DNS Server sources a new query if the name-to-IP resolution is not locally cached).

The things we have understood by your assistance but we could not found any document having the same use case or actual flow of DNS or its cache how they works.

Can  you please suggest any document or use case.