Sagan medium stable other
[FORTINET] DNS Request to Monitored Domain Detected
[FORTINET] DNS Request to Monitored Domain Detected
Detection Logic
alert any any any -> any any (msg: "[FORTINET] DNS Request to Monitored Domain Detected"; json_content: ".logid", "1501054802"; json_content: ".msg", "Domain is monitored"; json_content: ".action", "pass"; json_map: "src_ip", ".srcip"; json_meta_content: ".catdesc", Instant Messaging,File Sharing and Storage,Freeware and Software Downloads,Remote Access,Malicious Websites,Proxy Avoidance,Illegal or Unethical,Hacking,Crypto Mining,Child Sexual Abuse,Gambling,Nudity and Risque,Pornography,Peer-to-peer File Sharing,URL Shortening,Potentially Unwanted Program; json_meta_nocase; classtype: suspicious-traffic; sid:5015494; rev:3;) Field Validations
Loading…
Comments (0)
Loading comments...