Sagan medium stable other

[FORTINET] DNS Request to Monitored Domain Detected

[FORTINET] DNS Request to Monitored Domain Detected

View Source

Detection Logic

alert any any any -> any any (msg: "[FORTINET] DNS Request to Monitored Domain Detected";  json_content: ".logid", "1501054802"; json_content: ".msg", "Domain is monitored"; json_content: ".action", "pass"; json_map: "src_ip", ".srcip"; json_meta_content: ".catdesc", Instant Messaging,File Sharing and Storage,Freeware and Software Downloads,Remote Access,Malicious Websites,Proxy Avoidance,Illegal or Unethical,Hacking,Crypto Mining,Child Sexual Abuse,Gambling,Nudity and Risque,Pornography,Peer-to-peer File Sharing,URL Shortening,Potentially Unwanted Program; json_meta_nocase; classtype: suspicious-traffic; sid:5015494; rev:3;)

Field Validations

Loading…

Comments (0)

Loading comments...