DNS Security Dashboard Cards

Table of Contents

DNS Security Dashboard Cards

Where Can I Use This?	What Do I Need?
Prisma Access (Managed by Strata Cloud Manager) Prisma Access (Managed by Panorama) NGFW (Managed by Strata Cloud Manager) NGFW (Managed by PAN-OS or Panorama) VM-Series CN-Series	Advanced DNS Security License (for enhanced feature support) or DNS Security License Advanced Threat Prevention or Threat Prevention License

The cards populating the DNS Security dashboard are interactive and allows you to view additional details or pivot to a list of specific requests, events, and domains, as it pertains to how the content is shown.

The following list provides an overview of the DNS Security dashboard cards:

Card Name	Description
DNS Requests	Displays the total number of DNS requests that have been processed by DNS Security. The line chart diagrams the number of DNS requests based on the user-defined time range. Specifying a custom time range updates the line chart accordingly. The DNS category and action filters do not alter the card contents.
Malicious DNS Requests	Displays a stacked bar graph showing DNS requests that have been categorized based on the currently available types that are considered malicious. The total number is shown in the upper-left while a breakdown of categorical variables are indicated below. The line chart diagrams the number of DNS requests based on the user-defined time range. Specifying a custom time range updates the line chart accordingly. The DNS category and action filters do not alter the card contents.
Subscription	Displays the number of devices in your network with an active DNS Security subscription. A percentage of devices that are not equipped with DNS Security or with an elapsed subscription is also shown with a link to a complete list. You can select See a List of Devices to view a complete list. This card shows a snapshot of the current subscription status—the filter options do not have any impact.
High-Risk DNS Category Trend	Displays a trend chart showing a breakdown of the DNS requests based on the DNS category or the action applied to the DNS request over the observable time range. Select between a DNS category or action trend chart using the radio button. Hover over a segment on the steamgraph representing a data type to isolate and open a popup showing the number of DNS requests or type of action taken. Specifying a custom time range updates the trend chart accordingly. The DNS category and action filters highlight the selected variable in the card, but does not remove it from the chart.
DNS Category Distribution Across Actions	Displays a flow diagram that provides a visualization of the distributions of actions taken for high-risk DNS categories. A secondary table shows the actions taken for lower-priority DNS categories. Hover over a specific flow to open a popup showing the number of actions taken of the specified type. Specifying a custom time range updates the flow diagram accordingly. The DNS category and action filters do not alter the card contents. The top domains list is generated based on the filter settings applied at the top of the dashboard. Widgets that affect the overall page settings also determine which domains are shown. Hover over a bar to view usage statistics. Click on a domain to view DNS analysis details.
Domains	Displays the number of domains seen in your network, within your industry, other industries, as well as the total number, based on the selected DNS category. Allows you to compare your organization’s DNS usage to other organizations within the industry as well as against globally collected data, including a list of domain requests found exclusively in your network. The domains listed in this card include all DNS categories regardless of the DNS category and action filters. Only the time range updates the content of card.
Top 10 Domains	Provides a list of the top 10 most commonly requested domains from your network along with the DNS category and the action taken. You can view more details and the relevant logs for a domain by clicking the appropriate icon. Select View All DNS Requests for a complete list of domains that have been accessed. The domains listed in this card include all DNS categories regardless of the DNS category and action filters. Only the time range updates the content of card. Click on a domain to view DNS analysis details.
DNS Resolvers	Provides two lists showing the most resolved malicious domains and the least resolved domains in your network. Click on a DNS resolver to view DNS analysis details.
Misconfigured Domains (Advanced DNS Security)	Provides a list of non-resolvable domains associated with the user specified public-facing parent domain(s). For each entry, there is a misconfiguration reason and a traffic hit count based on the source IP.
Hijacked Domains (Advanced DNS Security)	Provides a list of hijacked domains as determined by Advanced DNS Security. For each entry, there is a categorization reason and a traffic hit count based on the source IP.