I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains. These are:

update.microsoft.com swscan.apple.com softwareupdate.vmware.com play.google.com autoupdate.opera.com auth.gfx.ms

I am not sure why but for some reason just these domains are creating ~10 million logs events per day. I've done a significant amount of research into this and nothing is jumping out at me. The only link I have been able to find is that these domains are a part of Fortigates default "Do Not Decrypt" SSL policy. And I can't even say that is 100% right.

Does anyone here have any thoughts or experience with this?


2 Answers 2


It's Fortinet querying them because match some of the FQDN Addresses defined in the Policy & Objects --> Addresses.

FortiGate will re-query the FQDN address 5 seconds before its TTL expires.

It can all be disabled either by deleting or moving them to Wildcard FQDN addresses.

See this Fortinet KB for more info: https://kb.fortinet.com/kb/documentLink.do?externalID=FD45787


Looks that those DNS queries are very common on Windows systems (update.microsoft.com) and android (play.google.com) as far I remember. The number or records generated by your SIEM depends on several factors such as the number of machines connected to your network, the number of sensors for capture information and so on.

In your case I will try to mark that domains as false negatives so your SIEM will not report them because are very common, but this is just my opinion.

  • I understand all of that. But the issue is that the Fortigates are creating far more A record requests than they should. Seems like they are doing the lookup every chance instead of caching the DNS locally
    – Joe
    Commented Jan 9, 2019 at 14:33

Not the answer you're looking for? Browse other questions tagged .