cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

1305
Views
5
Helpful
2
Replies
Highlighted
Beginner

Firepower FMC log analysis DNS results

Isn't there a way to see what the FQDN is within a DNS request? I have seen some DNS requests to an unexpected external DNS server and I would like to find out what the FQDN was that it sent the request to but I can't seem to find any report or way to see that just digging through logs from the Analysis of connection events. Please help.

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Beginner

Re: Firepower FMC log analysis DNS results

It would appear that I answered my own question. There is a DNS Query field and you can search based on that field and it appears to provide the FQDN that was queried.

View solution in original post

2 REPLIES 2
Highlighted
Beginner

Re: Firepower FMC log analysis DNS results

It would appear that I answered my own question. There is a DNS Query field and you can search based on that field and it appears to provide the FQDN that was queried.

View solution in original post

Highlighted
Hall of Fame Guru

Re: Firepower FMC log analysis DNS results

Thanks for sharing your answer. :)