DNS Security Dashboard Overview
Table of Contents
DNS Security Dashboard Overview
Scroll through the AutoFocus DNS Security dashboard
to view and drill down into various DNS trends discovered in your
network by AutoFocus. Each dashboard widget provides a unique view
into how DNS requests are processed and categorized. Clicking on
widgets allow you to change the context of the dashboard or view
more information about a specific trend, domain, or statistic.
If you are running DNS Security on PAN-OS 9.x, server response
and request data for cached verdicts and benign domains on the firewall
are not uploaded to AutoFocus. Expanded Data Collection for
DNS Security Improvements, which collects and forwards this
data to improve analytics, was added in PAN-OS 10.0.
From the DNS Security dashboard page, you can:
- View DNS request statistics and trends
- View DNS activity associated with malicious domains
- View the breakdown of DNS-based malware and request types
- View your organization's coverage (number of firewalls with a DNS Security license)
Filter the contents of your dashboard based on the DNS category
and the time-frame.
- Filter by DNS Category—Select from C2 (DGA, Tunneling, other C2), Malware, Newly Registered Domain, Phishing, Dynamic DNS, Allow List, Benign/Unknown, or Any Category, to filter the data set based on a DNS type.The Allow List category is a list maintained by Palo Alto Networks of explicitly allowable domains based on metrics from PAN-DB and Alexa. These allow list domains are frequently accessed and known to be free from malicious content.
- Filter by Period—Select from Last hour, Last 24 hours, Last 7 days, or Last 30 days to display data for a specific time-frame.
Drill Down on the DNS Security Dashboard Widgets for more details
on a specific DNS request trend or statistic.
For an overview of each of the dashboard widgets, see DNS Security Dashboard Widgets