I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains. These are:
I am not sure why but for some reason just these domains are creating ~10 million logs events per day. I've done a significant amount of research into this and nothing is jumping out at me. The only link I have been able to find is that these domains are a part of Fortigates default "Do Not Decrypt" SSL policy. And I can't even say that is 100% right.
Does anyone here have any thoughts or experience with this?