Forum Discussion
Mtee-
Mar 28, 2019Copper Contributor
Azure ATP Health - Low success rate of active name resolution using reverse DNS
Hello!
Got an alert about Domain controller health where issue is low success rate of active name resolutiong using reverse DNS:
Sensor X, has a low success rate of active name resolution using reverse DNS. Azure ATP may issue more false positive alerts and accurate detection capabilities may be affected.
Only recommendation is:
- Check that the Sensor can reach the DNS server and that Reverse Lookup Zones are enabled.
What does that mean? I have not done any changes to my DNS zones and reverse DNS is working fine.
Am I missing some reverse lookup zones?
Also I do not get any health alerts of other domain controllers from the domain which are in the same subnet.
- Mtee-Copper ContributorI checked also ATP sensor error logs and no new errors even if the ATP keeps alerting.
I am in a process of upgrading that 2012 R2 DC to 2019 so lets see if it alerts after that.
I have one 2019 DC and two 2012 R2 DCs in my environment. Only that one 2012 R2 is alerting about that name resolution and that is the fsmo role owner and DHCP server (where it differs from the 2019 DC which does not alert) - TheITDeptCopper Contributor
Same warning appeared. No DNS changes made. I wonder what's going on.
- Tali Ash
Microsoft
Hi Mtee- ,
Azure ATP is relying on the ability to resolve IPs to computers, using the process called Network Name Resolution.
To be able to do it Azure ATP is using 4 methods and when we observe a Sensor which has a high amount of resoultion failres of a specific methods a health alert is issued. We give this informaiton so you can make sure the environment is configured correctly, and in your example that there is an option to reolve computers using reverse DNS. In some cases this information should be hadled because it affects Azure ATP learning and detections functionalities. If you are seeing a lot of IPs and computers that are not resolved you should validate it. If everything looks good and computers are resolved, it means that other Sensors are working good in terms of resolution and it is enough or this Sensor has high failures of DNS but the RPC over NTLM and NetBIOS are working and it is ok.
You can read more about it here.
Thanks,
Tali