Forum Discussion
Default exclusions in Suspicious communication over DNS SA
What is the basis for adding those particular domains? They aren't "common" for us at all, so I removed them.
Do you intend to add other domains in future? If so will we be notified somehow, e.g. via O365 Message Center?
Hi Paul,
These 3 domains are the most popular in organizations with Azure ATP, most of Suspicious communication over DNS alerts were opened on them. In addition we observed that these 3 are also the most popular domains customers excluded from this alert. All 3 domains are known domains which owned by known companies that send to the domains data regarding their applications.
e5.sk - Eset
sophosxl.net - Sophos
spotify.com - Spotify
Therefore we decided to exclude these 3 domains by default, which will help for a lot of customers from doing it by their own, and give an option to remove it for others.
If we will see such similar need in the future to exclude more domains by default we will do it, and currently the communication channel is through the communities and it will also be updated in Azure ATP release notes.
Thanks,
Tali
Tali Ash Is there complete documentation containing a list of all default domain names in Microsoft's exclusions?
We're still generating the alert multi-times daily for excessive ('suspicious) sophosxl(.)net and e5(.)sk despite having modified the policy with our own exclusion. Our exclusions appear to be just be ignored by the policy.
- EliOfek
Microsoft
The list of exclusions is what you see in the exclusion list.
There are no overwrites in the code.
Not sure what you mean by "your own" exclusions, do you mean that the above 3 were removed from the list?
How exactly did you induce suspicious communication over dns ?
Just sending a simple DNS query will not suffice to trigger, doesn't matter how many times.
I don't really agree with the decision but thank you for the clarification.
