Question

A threat hunter has a GTI-sourced list of 40 suspicious domains tied to a commodity loader campaign. They run a UDM search over 30 days of DNS and HTTP proxy logs and find several matches, but they want to distinguish domains that were resolved but never actually connected to (potentially blocked or sinkholed) from domains where a full session was established. Which UDM search approach BEST lets them separate resolved-only activity from established-connection activity across both log sources in a single hunt?

Accepted Answer

Query both DNS (network.dns.questions.name) and network connection events (target.hostname / network.http) for the IOC set, then pivot on principal.hostname to compare which hosts show DNS-only versus DNS-plus-session activity

Answer

Search only network.dns events for the IOC domains, since DNS resolution is the earliest and most reliable indicator of compromise

Answer

Search only network.http events, because a successful HTTP session proves the domain was both resolved and connected, making DNS logs redundant

Answer

Convert the 40 domains into a YARA-L single-event rule and rely on the detection engine timeline, since UDM search cannot correlate two log sources