DNS request information

Prev Next

Events pertaining to requests from DNS servers or L7 network devices.

These events belong to the dns metaclass.

The domain field is used in intel matching.

Taxonomy

Type

Description

domain

string

Domain name. Typically seen in an HTTP, DNS, or authentication request.

protocol

string

Protocol used in a session (such as http, ftp, smtp)

querytype

integer

DNS record/query type (such as 1, 2, 6, 12, 28)

querytypename

string

DNS/record query type (such as A, NS, SOA, PTR, AAAA)