DNS dashboard
The DNS activity dashboard displays an overview of data relevant to the DNS infrastructure being monitored. The dashboard searches display results based on the time period selected using the dashboard time picker.
Dashboard filters
The DNS dashboard assists in searching DNS protocol data, refined by the search filters. The dashboard is used in ad-hoc searching of DNS data, but is also the primary destination for drilldown searches in the DNS dashboard panels.
The DNS search page displays no results unless it is opened in response to a drilldown action, or you set a filter or time range and select Submit.
| Filter by | Description |
|---|---|
| Destination | Destination IP address |
| Source | Source IP address |
| Message type | DNS message type: Query, Response, or All. |
| Query | DNS query |
| Reply Code | DNS reply type: All, All Errors, and a list of common reply codes |
Dashboard panels
| Panel | Description |
|---|---|
| DNS search | An ad-hoc search interface used to inspect Domain Name System (DNS) protocol data. |
| DNS events | Tracks individual Domain Name System transaction logs such as queries made by internal hosts and responses returned by DNS servers and standardized through the Common Information Model (CIM). |
Data sources
The reports in the DNS dashboard use fields in the network resolution data model. Relevant data sources include all devices or users generating DNS protocol traffic on the network captured from vulnerability scanners and packet analysis tools such as Splunk Stream and the Bro network security monitor.