: DNS Security Dashboard Overview
Focus
Focus

DNS Security Dashboard Overview

Table of Contents

DNS Security Dashboard Overview

Scroll through the AutoFocus DNS Security dashboard to view and drill down into various DNS trends discovered in your network by AutoFocus. Each dashboard widget provides a unique view into how DNS requests are processed and categorized. Clicking on widgets allow you to change the context of the dashboard or view more information about a specific trend, domain, or statistic.
If you are running DNS Security on PAN-OS 9.x, server response and request data for cached verdicts and benign domains on the firewall are not uploaded to AutoFocus. Expanded Data Collection for DNS Security Improvements, which collects and forwards this data to improve analytics, was added in PAN-OS 10.0.
From the DNS Security dashboard page, you can:
  • View DNS request statistics and trends
  • View DNS activity associated with malicious domains
  • View the breakdown of DNS-based malware and request types
  • View your organization's coverage (number of firewalls with a DNS Security license)
Filter the contents of your dashboard based on the DNS category and the time-frame.
  • Filter by DNS Category—Select from C2 (DGA, Tunneling, other C2), Malware, Newly Registered Domain, Phishing, Dynamic DNS, Allow List, Benign/Unknown, or Any Category, to filter the data set based on a DNS type.
    The Allow List category is a list maintained by Palo Alto Networks of explicitly allowable domains based on metrics from PAN-DB and Alexa. These allow list domains are frequently accessed and known to be free from malicious content.
  • Filter by Period—Select from Last hour, Last 24 hours, Last 7 days, or Last 30 days to display data for a specific time-frame.
Drill Down on the DNS Security Dashboard Widgets for more details on a specific DNS request trend or statistic.
For an overview of each of the dashboard widgets, see DNS Security Dashboard Widgets