DNS Query Length With High Standard Deviation
Description
This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment.
Content Mapping
This content is not mapped to any local saved search. Add mapping
Help |
---|
DNS Query Length With High Standard Deviation HelpTo successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. |
Search |
---|
Open in Search |