I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains. These are:

update.microsoft.com swscan.apple.com softwareupdate.vmware.com play.google.com autoupdate.opera.com auth.gfx.ms

I am not sure why but for some reason just these domains are creating ~10 million logs events per day. I've done a significant amount of research into this and nothing is jumping out at me. The only link I have been able to find is that these domains are a part of Fortigates default "Do Not Decrypt" SSL policy. And I can't even say that is 100% right.

Does anyone here have any thoughts or experience with this?

  • What kind of log? Please post some lines! – F. Hauri Jun 8 at 13:00

Looks that those DNS queries are very common on Windows systems (update.microsoft.com) and android (play.google.com) as far I remember. The number or records generated by your SIEM depends on several factors such as the number of machines connected to your network, the number of sensors for capture information and so on.

In your case I will try to mark that domains as false negatives so your SIEM will not report them because are very common, but this is just my opinion.

  • I understand all of that. But the issue is that the Fortigates are creating far more A record requests than they should. Seems like they are doing the lookup every chance instead of caching the DNS locally – Joe Jan 9 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.