{"id":1398,"date":"2018-07-12T21:46:59","date_gmt":"2018-07-12T21:46:59","guid":{"rendered":"https:\/\/live-infoblox-blog.pantheonsite.io\/?p=1398"},"modified":"2020-05-06T10:27:04","modified_gmt":"2020-05-06T17:27:04","slug":"top-security-report-1-dns-top-rpz-hits","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/community\/top-security-report-1-dns-top-rpz-hits\/","title":{"rendered":"Top Security Report #1: DNS Top RPZ Hits"},"content":{"rendered":"

This blog discusses the report #1 in a series of seven top security reports that can help you defend against bad actors.<\/p>\n

Here are the previous parts:\u00a0part 1<\/a>, part 2<\/a>,\u00a0part 3<\/a>,\u00a0part 4<\/a>,\u00a0part 5<\/a>,\u00a0part 6<\/a>,\u00a0part 7<\/a>\u00a0<\/p>\n

DNS Top RPZ Hits<\/h2>\n

Similar to top\u00a0report #2<\/a>, the DNS Top RPZ Hits report helps deliver data protection and malware mitigation by showing which clients have the most malicious activities using threat intel RPZ rules defined through Active Trust.\u00a0\u00a0Network admins<\/em><\/strong>\u00a0need to know which clients are conducting bad DNS network queries, for monitoring and pre-emptive action.\u00a0\u00a0Security admins<\/em><\/strong>\u00a0need to identify malicious real-time and historical clients and domains to cut response time for damage mitigation and resolution.\u00a0A typical security use case occurs when a security admin needs to identify all the\u00a0clients\u00a0that are visiting a known malicious domain or all malicious domains a known infected client is engaging.<\/p>\n\n\n\n\n\n\n\n\n\n
Top Report #1: DNS Top RPZ Hits<\/strong><\/td>\n<\/tr>\n
Service Area<\/strong><\/td>\nData Protection & Malware Mitigation<\/td>\n<\/tr>\n
Purpose<\/strong><\/td>\nShows clients with the most malicious activities<\/td>\n<\/tr>\n
Primary User<\/strong><\/td>\nNetwork & Security Admins<\/td>\n<\/tr>\n
Importance<\/strong><\/td>\nIdentifies RPZ domains which have the most hits from qualified malicious domains and shortens the time to identify malware impacts by tracking attempts made to reach domains on the RPZ list<\/td>\n<\/tr>\n
Use Case<\/strong><\/td>\nEnables security admins to identify all clients visiting a known malicious domain or all malicious domains a known infected client is engaging<\/td>\n<\/tr>\n
Available<\/strong><\/td>\nOut-of-the-box & requires Active Trust\/Active Trust Cloud (AT\/ATC)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

This report is located through the security dashboard and utilizes Active Trust\/Active Trust Cloud.\u00a0 Admins can search and sort by time, top Number, client IP, domain name, DNS view, members, mitigation action, RPZ zone, RPZ entry, severity and detailed aggregated hits count.\u00a0 Admins can filter by severity level (all, critical, major, warning and informational) to quickly parse the domains that are of critical or major levels of concern, so they can run a virus scan or send it for further action by the security team.\u00a0 It can also be saved to run automatically at regular intervals, and if rules are violated, it can be programmed to trigger an alert, transfer a raw data file for further processing, run a script, send an SNMP trap to a security system, send an email to the security team, pass the alert to the syslog or other actions.\u00a0 This report can be used to share data with the security ecosystem and other tools on the network, to help identify and stop threats in their tracks.<\/p>\n

\"Top<\/p>\n

Here are the seven (7) security reports that can give you an edge over the bad actors.<\/p>\n