DNS Query Length With High Standard Deviation
This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment.
DNS Query Length With High Standard Deviation Help
To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model.
Open in Search