DNS Security Monitor

What it does

GuardFox EDR agents report the DNS queries seen on each host. The DNS Security Monitor ingests those queries, scores every domain, and stores the result as a DNS event. Queries judged malicious are highlighted in the feed and, in parallel, raise an Alert and run any matching SOAR playbooks.

The scoring pipeline

When a batch of query events arrives, each domain is checked in this order:

1. Threat-intel watchlist — the domain is matched against your organization's active domain watchlist entries.
2. DGA heuristic — a Shannon-entropy and consonant-ratio test that flags random-looking domain-generation-algorithm labels.
3. DNS tunneling heuristic — flags very long domains and dotted TXT lookups that suggest data exfiltration over DNS.
4. Suspicious TLD — domains ending in .onion, .bit, or .i2p.

If any check matches, the event is stored as malicious with a threatType of c2, dga, or tunneling and a confidence score. Clean queries are stored too (they appear when the feed's threat filter is switched off).

Multi-tenancy

The feed, threat-type breakdown, and Domain Analyzer are all scoped to your organization — you only see events reported by agents in your own tenant.

The event feed

The main table lists recent DNS events, newest first, with these columns: Threat (the threat-type tag, or clean), Domain (with the first resolved IP beneath it), Host (the querying machine), Confidence, and Time. Confidence is colored red at 80% and above, amber from 50%, and grey below.

• Threats Only toggle (top right) — on by default; filters the feed to malicious events. Toggle it to All Queries to include clean lookups.
• Search box — filters the feed by domain substring.
• Threat-type chips — above the feed, a colored chip per threat type shows how many malicious events fall into each category.

Event detail & triage actions

Click any row to open the DNS Threat Diagnostics modal. It shows the query type, first resolved IP, client host, and a behavior-analysis note tailored to the threat type. Three actions are available:

• Block Domain (DNS Firewall) — issues a DNS-firewall block for the domain and shows an in-app confirmation banner.
• Isolate Querying Host (EDR) — looks up the enrolled EDR agent whose hostname matches the querying host and sends it a quarantine command. If no matching agent is enrolled, the modal reports that instead.
• Escalate to Ticket — creates an incident ticket for the event. Severity is derived from confidence: Critical at 80% or above, High from 50%, otherwise Medium.

Domain Analyzer

The right-hand panel lets you check any domain on demand. Enter a domain and it returns a clean / malicious verdict (based on a watchlist match), the live-resolved IPs, how many stored DNS events reference the domain, when it was first seen, and which hosts have queried it.

Each domain is evaluated by the checks below, in order. The first check that fires sets the threat type and confidence; an event is marked malicious if any check matches.

Non-malicious queries are stored with confidence 0 and no threat type, and render as clean in the feed. Every malicious event additionally creates an Alert (source dns-monitor) and triggers any SOAR playbooks that match it.

Submit DNS events (agents)

Agents post batches of query events to this endpoint. It authenticates with the shared agent API key (header x-agent-key, or an Authorization: Bearer token) and requires EDR_AGENT_API_KEY to be configured server-side — if it is not set, the endpoint returns 503. Up to 200 events are processed per request, and the organization is resolved from the reporting agent’s agentId. The response is { "created": n }.

curl -X POST https://portal.guardfoxsecurity.com/api/dns/events \
  -H "x-agent-key: $EDR_AGENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "agentId": "agent-abc123",
    "hostname": "WIN-FINANCE-04",
    "events": [
      { "domain": "kq3v9zx1p7whate.com", "queryType": "A", "resolvedIPs": ["185.220.101.34"] }
    ]
  }'

Each item in events accepts domain (required), queryType (defaults to A), and resolvedIPs (defaults to an empty list).

List DNS events

Session-authenticated. Returns the latest 500 events for your organization plus a per-threat-type count breakdown.

Response shape: { events, stats, total }, where stats is a grouped count by threatType over malicious events.

Analyze a domain

Session-authenticated. Checks the domain against your watchlist and stored events, and resolves its A records live via Cloudflare DNS-over-HTTPS.

curl "https://portal.guardfoxsecurity.com/api/dns/analyze?domain=example.com" \
  -H "Cookie: "