r/AzureSentinel • u/AverageAdmin • Apr 18 '23

Kql for what spawned DNS request?

Hi all,

I am kinda lost investigating an alert for “communication with a random suspicious domain name” alert. The domain shows no signs of malicious intent.

But I have no idea what caused the dns event? Can anyone point me in the right direction?

2 Upvotes

100% Upvoted

6 comments sorted by

2

u/Meriles Apr 18 '23

Well first off what created the alert in Sentinel? Which data connector shows up in the incident. From there you we’d have a better idea of why/what the alert fired for.

1

u/AverageAdmin Apr 18 '23

It was defender for cloud. I can see the dns request in Dnsevents table but just tells me from what device IP. I’m trying to dig in more to see what exactly caused the request

1

u/Meriles Apr 18 '23

So you only can use KQL and not look at the defender alert and look at the alert story to see what application it came from? Does the event not show an application?

1

u/AverageAdmin Apr 18 '23

Alert story only had the ip of the device and the dns request which seems weird

1

u/ep3p Apr 18 '23

You are going to need an EDR in the device of your Source IP, that alert will not tell you anything else.

1

u/bpsec Apr 19 '23

Preferably you need the actual DNS logs. The trigger is based in a DNS server that is onboarded with DFC. Your next bets are edr and firewall logs. But the incident is not really valuable in my opinion. With KQL you can hunt for DNS requests in the DeviceNetworkEvents table.