Potential DGA(Domain Generation Algorithm) detected via Repetitive Failures - Anomaly based (ASIM DNS Solution)

Requête originale, sans modification.

let threshold = 2.5;
let min_t = ago(14d);
let max_t = now();
let timeframe = 1d;
// calculate avg. eps(events per second)
let eps = materialize (_Im_Dns
  | project TimeGenerated
  | where TimeGenerated > ago(5m)
  | count
  | extend Count = Count / 300);
let maxSummarizedTime = toscalar (
  union isfuzzy=true 
      (
      DNSEssentialsCustomParser
      | where Type in ("DNS_Summarized_Logs_ip_CL", "DNS_Summarized_Logs_ipV1_CL") 
      | where EventTime_t >= min_t
      | summarize max_TimeGenerated=max(EventTime_t)
      | extend max_TimeGenerated = datetime_add('hour', 1, max_TimeGenerated)
      ),
      (
      print(min_t)
      | project max_TimeGenerated = print_0
      )
  | summarize maxTimeGenerated = max(max_TimeGenerated) 
  );
let summarizationexist = materialize(
  union isfuzzy=true 
      (
      DNSEssentialsCustomParser
      | where Type in ("DNS_Summarized_Logs_ip_CL", "DNS_Summarized_Logs_ipV1_CL")
      | where EventTime_t > ago(1d) 
      | project v = int(2)
      ),
      (
      print int(1) 
      | project v = print_0
      )
  | summarize maxv = max(v)
  | extend sumexist = (maxv > 1)
  );
let allData = union isfuzzy=true
      (
      (datatable(exists: int, sumexist: bool)[1, false]
      | where toscalar(eps) > 1000
      | join (summarizationexist) on sumexist)
      | join (
          _Im_Dns(responsecodename='NXDOMAIN', starttime=todatetime(ago(2d)), endtime=now())
          | where TimeGenerated > maxSummarizedTime
          | summarize Count=count() by SrcIpAddr, DnsQuery, bin(TimeGenerated, 1h)
          | extend EventTime = TimeGenerated, Count = toint(Count), exists=int(1)
          )
          on exists
      | project-away exists, maxv, sum*
      ),
      (
      (datatable(exists: int, sumexist: bool)[1, false]
      | where toscalar(eps) between (501 .. 1000)
      | join (summarizationexist) on sumexist)
      | join (
          _Im_Dns(responsecodename='NXDOMAIN', starttime=todatetime(ago(3d)), endtime=now())
          | where TimeGenerated > maxSummarizedTime
          | summarize Count=count() by SrcIpAddr, DnsQuery, bin(TimeGenerated, 1h)
          | extend EventTime = TimeGenerated, Count = toint(Count), exists=int(1)
          )
          on exists
      | project-away exists, maxv, sum*
      ),
      (
      (datatable(exists: int, sumexist: bool)[1, false]
      | where toscalar(eps) <= 500
      | join (summarizationexist) on sumexist)
      | join (
          _Im_Dns(responsecodename='NXDOMAIN', starttime=todatetime(ago(4d)), endtime=now())
          | where TimeGenerated > maxSummarizedTime
          | summarize Count=count() by SrcIpAddr, DnsQuery, bin(TimeGenerated, 1h)
          | extend EventTime = TimeGenerated, Count = toint(Count), exists=int(1)
          )
          on exists
      | project-away exists, maxv, sum*
      ),
      (
      DNSEssentialsCustomParser
      | where Type in ("DNS_Summarized_Logs_ip_CL", "DNS_Summarized_Logs_ipV1_CL")
      | where EventTime_t > min_t and EventResultDetails_s == 'NXDOMAIN'
      | project-rename
          SrcIpAddr=SrcIpAddr_s,
          DnsQuery=DnsQuery_s,
          Count=count__d,
          EventTime=EventTime_t
      | extend Count = toint(Count)
      );
allData
| make-series QueryCount=dcount(DnsQuery) on EventTime from min_t to max_t step timeframe by SrcIpAddr
// include calculated Anomalies, Score and Baseline
| extend (anomalies, score, baseline) = series_decompose_anomalies(QueryCount, threshold, -1, 'linefit')
| mv-expand anomalies, score, baseline, EventTime, QueryCount
| extend
  anomalies = toint(anomalies),
  score = toint(score),
  baseline = toint(baseline),
  EventTime = todatetime(EventTime),
  Total = tolong(QueryCount)
| where EventTime >= ago(timeframe)
| where score >= threshold * 2
// Join allData to include DnsQuery details
| join kind=inner(allData
  | where TimeGenerated >= ago(timeframe)
  | summarize DNSQueries = make_set(DnsQuery, 1000) by SrcIpAddr)
  on SrcIpAddr
| project-away SrcIpAddr1