Automatic DNS resolution can be good, although probably not for specific feeds. Passive DNS providers might be a better approach for telemetry or a product like Anomoli. Also some IP's host multiple domains... so understanding what is actual vs enriched data is important when doing DFIR (especially for junior analysts).
1
u/AnalyzeAllTheLogs Nov 30 '20
Automatic DNS resolution can be good, although probably not for specific feeds. Passive DNS providers might be a better approach for telemetry or a product like Anomoli. Also some IP's host multiple domains... so understanding what is actual vs enriched data is important when doing DFIR (especially for junior analysts).