Skip to content

Instantly share code, notes, and snippets.

@faststeak

faststeak/gist:a2c66f44a55014f351c408fede9c5b12

Created June 12, 2018 17:54
Show Gist options
  • Save faststeak/a2c66f44a55014f351c408fede9c5b12 to your computer and use it in GitHub Desktop.
Save faststeak/a2c66f44a55014f351c408fede9c5b12 to your computer and use it in GitHub Desktop.
Download ZIP
Splunk - Search to find host/ip pairs with DNS data
Raw
gistfile1.txt
| tstats summariesonly=true allow_old_summaries=true values(DNS.answer) as ip_query from datamodel=Network_Resolution.DNS where "DNS.message_type"=RESPONSE "DNS.record_type"=A* NOT DNS.answer="unknown" AND NOT DNS.answer="127.*" AND NOT DNS.answer="*:*" AND NOT DNS.query="*._msdcs.*" by "DNS.query"
| rename DNS.query as dns
| lookup cim_corporate_web_domain_lookup domain as dns output domain as found
| search found=*
| eval dns=lower(dns)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment