DNS Query Length With High Standard Deviation

DNS Query Length With High Standard Deviation

Description

This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment.

   Help

DNS Query Length With High Standard Deviation Help

To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model.

   Search

Open in Search