Isn't there a way to see what the FQDN is within a DNS request? I have seen some DNS requests to an unexpected external DNS server and I would like to find out what the FQDN was that it sent the request to but I can't seem to find any report or way to see that just digging through logs from the Analysis of connection events. Please help.
It would appear that I answered my own question. There is a DNS Query field and you can search based on that field and it appears to provide the FQDN that was queried.
It would appear that I answered my own question. There is a DNS Query field and you can search based on that field and it appears to provide the FQDN that was queried.
