ConceptsDNS Logs

DNS Logs

Records of DNS queries and responses, capturing which domains hosts looked up and when. They are a high-value telemetry source for detecting malware, command-and-control, data exfiltration, and suspicious domains.

Glossary definition

8 direct links6 lessons

Concept Neighborhood

Prerequisite · arrow shows the orderRelated · bigger circles cover more lessons

Start here

Flow Data

The most substantial related concept here, covered by 6 lessons.

Open concept →

Builds towardDNS Logs is a foundation for these

DNS-Based Detection

Detection techniques that use DNS query data to find threats, spotting lookups of malicious, newly registered, or algorithmically generated domains, beaconing patterns, and DNS tunneling, often written as SIEM queries over DNS logs.

lessons

Relatedsorted by lesson coverage

Flow DataStart here

lessons

Network Telemetry

lessons

Proxy Logs

lessons

DNS over HTTPS (DoH)

lesson

DNS Tunneling

lesson

MX Record

lesson

Show 1 more connection

Resolver

lesson

Related Lessons

6 lessons cover this concept

Design Security Telemetry

General Beginner

Build Reliable Source Coverage

General Beginner

Protect the Telemetry Pipeline

General Beginner

Store, Query, and Govern Telemetry

General Beginner

Make Telemetry Detection-Ready

General Beginner

Operate and Improve Telemetry

General Beginner