<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Analyzing DNS Security Logs

## DNS Log Sources

| Source | Event/Log | Key Fields |
|---|---|---|
| Sysmon EID 22 | DNS Query | QueryName, QueryStatus, Image |
| Windows DNS Server | Analytical log | QNAME, QTYPE, RCODE, ClientIP |
| Zeek `dns.log` | Network capture | query, qtype, rcode, id.orig_h |
| PassiveDNS | Passive collection | domain, rrtype, answer |

## DNS Threat Indicators

| Indicator | Threshold | Threat |
|---|---|---|
| Subdomain length | > 50 chars | DNS tunneling |
| Domain entropy | > 3.8 Shannon | DGA |
| NXDOMAIN rate | > 50/hour per host | DGA |
| Query periodicity | stdev < 1.0 over 60+ min | C2 beaconing |
| TXT record size | > 255 bytes | Data exfiltration |

## Agent Script

```bash
# Analyze a single domain
node agent.js analyze-domain "a8f3k2m9x7.evil.com"

# Analyze DNS log file
node agent.js analyze-log /var/log/dns/queries.log --threshold 3.8

# Generate hunt queries for DNS tunneling
node agent.js hunt-queries --type tunneling --platform splunk
```
