Suspicious DNS Query list

Reply
Highlighted
Not applicable

Suspicious DNS Query list

Hello,

Is there a list of all the DNS Querys that PA considers suspicious?

I was considering changing the default action from alert to block for these signatures.

Since there is potentially 1 million URLs that will automatically get blocked when adjusted, my client might want to go over the list before making the decision.

PA DNS Sig.JPG

Thanks!


Accepted Solutions
Highlighted
L7 Applicator

That list is a "living database" and changes over time.  I think a better method to use with your customer would be to understand "what would have been blocked".  You can run a simple custom report to answer that question.  Use the "Threat Log" as your data source and use the following options (feel free to change your timeframe - just keep in mind the longer the timeframe the longer the report may take to run.  Start small ~1 day and then work your way up). 

Screen Shot 2014-08-15 at 3.18.47 PM.png

In my small lab environment, the output looks like this:

Screen Shot 2014-08-15 at 3.22.22 PM.png

View solution in original post


All Replies
Highlighted
L7 Applicator

That list is a "living database" and changes over time.  I think a better method to use with your customer would be to understand "what would have been blocked".  You can run a simple custom report to answer that question.  Use the "Threat Log" as your data source and use the following options (feel free to change your timeframe - just keep in mind the longer the timeframe the longer the report may take to run.  Start small ~1 day and then work your way up). 

Screen Shot 2014-08-15 at 3.18.47 PM.png

In my small lab environment, the output looks like this:

Screen Shot 2014-08-15 at 3.22.22 PM.png

View solution in original post

Highlighted
L7 Applicator

I agree with Jared.  Even if you could see the whole database, and the chances are low that PA would allow that.  I'm sure they consider those contents a trade secret they want to keep from the competition, the report is more relevant.

The report tells you what your users are likely to see on your network.

Remember also that generally when a default action is to alert instead of block, there is a much higher possibility of a false positive.  So you may generate some work allowing blocked sites after the action is changed.

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center
Highlighted
Not applicable

Thanks for your replies.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!