Hi,
I wouldn't recommend to focus on the single finding. Indicator-of-compromise category contains rules that should be used for the detection of a positively compromised system and false positives may occur.
When evaluating an event, all the intrusion chain should be evaluate.
A single alert may happen either while browsing and get a redirection that force the resolution of a .pw dns query or if a malicious process is running on the host.
First of all carefully check the rule content and confront it with your variable_set it might already vanish some doubts.
Your controller most likely is the DNS resolver as well that's why you get the alert from this host.
You should identify the client that generate the query. Once the client is identified, you could investigate a bit deeper on this host. If your network configuration doesn't give you visibility between client and dns server you can setup a sinkhole.
Again, don't focus on a single clue. You should get a broader vision of your landscape.
That's what analysts do.
Last but not the least, remember that each managed device can be targeted by only one access control policy.
Hope this can help!
Regards
