Introduction

The DNS Reports page (Network Section) is presented as a list view that shows every DNS report that Field Effect has generated.

This article introduces the DNS Reports page and how to navigate it, as well as how to use the predictive search functionality, edit and filter columns, and sort the view.

Navigating the Agents Page

The List View

This page is presented as a table showing all DNS Reports Field Effect has generated for an organization. Columns can be resized, rearranged, and shown or hidden to suit your needs.

The Details View

Clicking a row will expose more details about the selected endpoint agent along bottom of the table.

The Details view can also be expanded into a modal view using the Expand icon.

Editing Columns

Columns can be shown or hidden to suit your needs. To edit a view’s columns, click Edit Columns. The Edit Columns tool will open, listing all the columns available for the view. Use the checkmarks to select the columns you want to use in the table. Unchecked columns will not be visible. Once you’ve made your selections, click Apply.

The size of each column can also be adjusted. Use the arrows in the column header to sort and drag the edge of the column to adjust the width.

Viewing Reports

Clicking on a line item’s View Report button will open the report, revealing more tabs related to the specific report.

The Report is comprised of six tabs: Overview, Resolved Ips, DNS Requests, Communications, Connections, and Processes.

Each tab, except the Overview, is presented as as table and contain the following columns:

• Resolved IPs:
  • IP Address, Average Bytes, Bytes In, Bytes Out, Continuing Connections, First Seen (UTC), Last Seen (UTC), Terminated Connections, Total Bytes, and Total Connections.
• DNS Requests:
  • First Seen (UTC), Host Name, Last Seen (UTC), Nameserver IP, Requester IP, Resolution Count, and Resolved IP.
• Communications
  • Host Name, IP Address, Node. Average Bytes, Bytes In, Bytes Out, Communicating Connections, First Seen (UTC), Last Seen (UTC), Terminated Connections, Total Bytes, and Total Connections.
• Connections:
  • Bytes In, Bytes Out, Continuing Connections, Destination Port, Destination IP, Duration, First Seen (UTC), Swapped, Last Seen (UTC), Packets In, Packets Out, Protocol, Source IP, and Terminated Connections.
• Processes:
  • Command Line, Host Name, IP Address, Destination Port, First Seen (UTC). Last Seen (UTC), Node ID, Process Name, Process Path, and Resolved IP.

Searching for DNS Reports

The search bar leverages logic that allows you to create custom queries to find and filter alerts. You can use logic to create your own searches (“Category” column contains “XYZ”) or perform keyword searches.

After selecting a suggested column from the dropdown, suggested logic statements will become visible. Select the logic statement that suites your search to continue.

After selecting a logic statement, suggested search choices specific to the selected column will become visible. In the example below, the user chose the End Time column and Contains logic statement. Therefore, the dropdown shows available UTC times found in the list as suggestions.

Also note that you are not restricted to suggestions, you can add custom search queries to logic statements, or perform basic keywork searches.

Sorting & Filtering DNS Reports

To sort the Agents list, click on a column header to toggle between a descending or ascending order for the selected column. You can also use the “Order By” feature shown as a suggested search function.

To filter the list, you can use the “Is Not” or “Is Null” suggestions. Using “Is not” will query results that do not include selected suggestions or provided keywords. The “Is Null” suggestion will query items with no content in the selected column.

As you make selections, you will be prompted with suggestions as shown above in Searching for DNS Reports.

Exporting Results

You can export the entire list of alerts, or a filtered subsection, using the Export .csv icon. The export will be downloaded to your default folder.