Get in touch
← Sentinel Explorer
↳ GitHub sourceAnalytics ruleMedium

Forescout-DNS_Sniff_Event_Monitor

View on GitHub ↗Original file ↗

Description

This rule creates an incident when more than certain number of Dnsniff events are generated from a host
Rule type
Scheduled
Version
2.0.2
Query frequency
5m
Query period
5m
Trigger
gt 0

KQL query

Original query, unchanged.

ForescoutHostProperties_CL | extend  d = parse_json(HostProperties) | where d.DnsniffEvent matches regex "DNS Query Type:.A;DNS Query/Response:.Query" | extend ipaddress = iif(isnotempty(Ipv4Addr), Ipv4Addr, (iif(isnotempty(Ipv6Addr), Ipv6Addr, ""))) | where isnotempty(ipaddress) and isnotempty(EmIpAddr) | summarize NumEvents_d =count() by ipaddress, EmIpAddr | where NumEvents_d > 2 | sort by NumEvents_d asc | project NumEvents_d, ipaddress, EmIpAddr

Declared entities

IP

Related content

Links established from declared identifiers and solution manifests.

Solutions1

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
d272e277-f285-4dbc-ae2d-7f65ba64a79e
Additional source files 2Solutions/ForescoutHostPropertyMonitor/Analytic Rules/ForeScout-DNSSniffEventMonitor.yamlsource ↗Solutions/ForescoutHostPropertyMonitor/Data/Solution_ForescoutHostProp.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.