ALT-2421 · DNS
Excessive DNS NXDOMAIN from single host
412 NXDOMAIN responses in 10 minutes matching DGA-like patterns.
lowInvestigatingconfidence 58% · 1970-01-01 04:11:00Z · rule DET-0033 DGA Heuristic
Detection summary
412 NXDOMAIN responses in 10 minutes matching DGA-like patterns.
- Affected host
- WS-FIN-014
- Affected user
- s.hartono
- Source IP
- 10.20.34.207
- Detection rule
- DET-0033 DGA Heuristic
- Log source
- DNS
- Assignee
- S. Hartono
Recommended actions
- Verify against known DGA feeds
- Check for a misconfigured client first
Analyst decision
Triage checklist
- 1. Confirm the detection logic matched genuine activity.
- 2. Check user and asset context for expected behaviour.
- 3. Pivot on host, user, IP and hash in the Log Explorer.
- 4. Enrich IOCs with threat intelligence.
- 5. Set a verdict and record your reasoning.