I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains. These are:

update.microsoft.com swscan.apple.com softwareupdate.vmware.com play.google.com autoupdate.opera.com auth.gfx.ms

I am not sure why but for some reason just these domains are creating ~10 million logs events per day. I've done a significant amount of research into this and nothing is jumping out at me. The only link I have been able to find is that these domains are a part of Fortigates default "Do Not Decrypt" SSL policy. And I can't even say that is 100% right.

Does anyone here have any thoughts or experience with this?

  • 1
    What kind of log? Please post some lines! – F. Hauri Jun 8 '19 at 13:00

It's Fortinet querying them because match some of the FQDN Addresses defined in the Policy & Objects --> Addresses.

FortiGate will re-query the FQDN address 5 seconds before its TTL expires.

It can all be disabled either by deleting or moving them to Wildcard FQDN addresses.

See this Fortinet KB for more info: https://kb.fortinet.com/kb/documentLink.do?externalID=FD45787

| improve this answer | |

Looks that those DNS queries are very common on Windows systems (update.microsoft.com) and android (play.google.com) as far I remember. The number or records generated by your SIEM depends on several factors such as the number of machines connected to your network, the number of sensors for capture information and so on.

In your case I will try to mark that domains as false negatives so your SIEM will not report them because are very common, but this is just my opinion.

| improve this answer | |
  • I understand all of that. But the issue is that the Fortigates are creating far more A record requests than they should. Seems like they are doing the lookup every chance instead of caching the DNS locally – Joe Jan 9 '19 at 14:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.