Forum Discussion

Chuck99's avatar
Chuck99
Brass Contributor
Sep 11, 2019

DNS reconnnaissance tests cannot be seen during the 8-day Learning Period

Hello, We are implementing Azure ATP and we have deployed sensors on our DCs. We want to test that the solution work by doing some network-mapping DNS reconnaissance activity (with nslookup) describe...
PJR_CDF's avatar
PJR_CDF
Iron Contributor
Oct 17, 2019

Chuck99 Tali Ash 

 

I am seeing the exact same behaviour in my lab setup.

 

Did you get to the bottom of this issue?

Chuck99's avatar
Chuck99
Brass Contributor
Oct 17, 2019

PJR_CDF 

Hi, I opened a support case and it was raised to the Product Group who was able to reproduce the issue. They are working on a fix that should soon be available. :smile:

  • PJR_CDF's avatar
    PJR_CDF
    Iron Contributor
    Oct 17, 2019

    Chuck99 

     

    Thanks Chuck. Glad to know it's not just me and something related to my setup!

     

    Did you start receiving the alerts in the timeline view after 8 days?

     

    Paul

    • Chuck99's avatar
      Chuck99
      Brass Contributor
      Oct 17, 2019

      PJR_CDF 

       

      Some of them but not all. All I know is that the issue seems to be related to the AXFR process that is drove by the TCP protocol instead of the UDP protocol.

Resources