{"id":1332,"date":"2018-07-06T21:16:28","date_gmt":"2018-07-06T21:16:28","guid":{"rendered":"https:\/\/live-infoblox-blog.pantheonsite.io\/?p=1332"},"modified":"2020-05-06T10:27:05","modified_gmt":"2020-05-06T17:27:05","slug":"top-security-report-7-dns-top-nxdomain-noerror","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/community\/top-security-report-7-dns-top-nxdomain-noerror\/","title":{"rendered":"Top Security Report #7: DNS Top NXDOMAIN \u2013 NOERROR"},"content":{"rendered":"

This blog discusses the report #7 in a series of seven top security reports that can help you defend against bad actors.<\/p>\n

Please see the part 1 of this series\u00a0here<\/a>.<\/p>\n

Top Security Report #7: DNS Top NXDOMAIN \u2013 NOERROR<\/h1>\n

Top report #7 is a favorite among network and security admins because it shows the source and patterns of attacks that affect network availability.\u00a0 A barrage of DNS queries can quickly fill-up the DNS server cache with non-existing domains.\u00a0 When filled, the network slows down substantially, and legitimate queries don\u2019t get answered as quickly, or at all.\u00a0 From a\u00a0network perspective<\/em><\/strong>, it\u2019s a very helpful report that quickly indicates that a client is mistyped, misspelled, misconfigured, renamed, changed, expired or removed.\u00a0 It returns an NXDOMAIN \u2013 NOERROR message showing that there are queries still seeking the target domain, quickly alerting you to problems with the domain or client.\u00a0 From a\u00a0security perspective,\u00a0<\/em><\/strong>this report identifies when a client is doing something bad on the network.\u00a0 Using the previous data exfiltration example, the malware uses a domain name generation algorithm, searching among thousands of generated names to find one active attack vector.\u00a0 This, in turn, generates lots of NXDOMAIN activity, filling-up the cache, much like a DDoS attack, degrading server response and penalizing legitimate traffic.<\/p>\n\n\n\n\n\n\n\n\n\n
Top Report #7: DNS Top NXDOMAIN – NOERROR<\/strong><\/td>\n<\/tr>\n
Service Area<\/strong><\/td>\nInfrastructure Protection<\/td>\n<\/tr>\n
Purpose<\/strong><\/td>\nLists DNS queries that result in NXDOMAIN or NOERROR (no data) response<\/td>\n<\/tr>\n
Primary User<\/strong><\/td>\nNetwork\/Security Admins<\/td>\n<\/tr>\n
Importance<\/strong><\/td>\nIdentifies queries to renamed or removed servers & finds misconfigurations by showing DNS queries that result in NXDOMAIN & NOERROR (no data) responses<\/td>\n<\/tr>\n
Use Case<\/strong><\/td>\nA client is infected with malware that uses a domain generation algorithm. This client generates a large amount of NXDOMAIN activity & fills-up the cache reducing DNS server response times to legitimate queries.<\/td>\n<\/tr>\n
Available<\/strong><\/td>\nOut-of-the-box & requires Advanced Data Protection (ADP)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

This is a standard report available through the security dashboard and requires Advanced Data Protection (ADP).\u00a0 Like virtually all Infoblox reports, filtering is robust, flexible and intuitive making it easy to get the information you need.\u00a0 You can define monitored timeframes, set how data is displayed (e.g., from visualized bar charts to raw data tables), identify top 10 (or N) domains, filter by member, DNS view and more.\u00a0 Using the Splunk interface, you can see the raw dataset, and create custom dashboards or reports without starting from scratch. \u00a0\u00a0All of this gives you the quick power to see a troubled or malware-infected domain rather than getting caught long after the damage is done.<\/p>\n

\"DNS<\/p>\n

In the next few blogs, we will walk you through the seven (7) security reports that can give you an edge over the bad actors.<\/p>\n