{"id":1384,"date":"2018-07-12T21:38:36","date_gmt":"2018-07-12T21:38:36","guid":{"rendered":"https:\/\/live-infoblox-blog.pantheonsite.io\/?p=1384"},"modified":"2020-05-06T10:27:04","modified_gmt":"2020-05-06T17:27:04","slug":"top-security-report-3-dns-top-tunneling-activity","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/community\/top-security-report-3-dns-top-tunneling-activity\/","title":{"rendered":"Top Security Report #3 – DNS Top Tunneling Activity"},"content":{"rendered":"

This blog discusses the report #3 in a series of seven top security reports that can help you defend against bad actors.<\/p>\n

Here are the previous parts:\u00a0part 1<\/a>, part 2<\/a>,\u00a0part 3<\/a>,\u00a0part 4<\/a>,\u00a0part 5<\/a><\/p>\n

DNS Top Tunneling Activity<\/h2>\n

Similar to\u00a0report #4<\/a>, the DNS Top Tunneling Activity report enables data protection and malware mitigation by listing the overall tunneling activity by client, rather than the category, to show the highest number tunneling activities within a specific period.\u00a0\u00a0Network and security admins<\/em>\u00a0use it frequently because it identifies the clients most often performing DNS tunneling activities and supports security forensics so that teams can take corrective action.\u00a0 It\u2019s a critical report for identifying clients attempting to exfiltrate company data through any DNS tunneling.<\/p>\n\n\n\n\n\n\n\n\n\n
Top Report #3: DNS Top Tunneling Activity<\/strong><\/td>\n<\/tr>\n
Service Area<\/strong><\/td>\nData Protection & Malware Mitigation<\/td>\n<\/tr>\n
Purpose<\/strong><\/td>\nLists the clients that have the greatest number of DNS tunneling activities in a given timeframe<\/td>\n<\/tr>\n
Primary User<\/strong><\/td>\nNetwork & Security Admins<\/td>\n<\/tr>\n
Importance<\/strong><\/td>\nIdentifies the clients most often performing DNS tunneling activities, so Security can conduct forensic investigation & take action on those clients<\/td>\n<\/tr>\n
Use Case<\/strong><\/td>\nEnables Security admins to identify clients attempting to exfiltrate company data through any DNS tunneling<\/td>\n<\/tr>\n
Available<\/strong><\/td>\nOut-of-the-box & requires Advanced DNS Protection (ADP)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

As before, the report is accessed through the security dashboard and requires ADP.\u00a0 Admins can sort by time, top Number of tunneling instances, members, source IP addresses, source ports, NAT status and bar chart, data table or combined views.\u00a0 Again, this data can be captured in .pdf and emailed automatically to designated teams.\u00a0 The overall DNS Top Tunneling report is essential for identifying, triaging and removing sources of malware tunneling and data exfiltration on the network.<\/p>\n

\"Top<\/p>\n

Here are the seven (7) security reports that can give you an edge over the bad actors.<\/p>\n