Detect DNS in Sumo Logic CSE

(_sourceCategory=*dns* OR _sourceCategory=*sysmon* OR _sourceCategory=*windows/events* OR _sourceCategory=*endpoint*)

/* Normalize raw message for multi-source pattern matching */
| parse "*" as raw_msg

/* Branch 1: Zone Transfer keyword detection */
| eval zone_xfer = if(
    raw_msg matches "*AXFR*" or raw_msg matches "*IXFR*" or raw_msg matches "*type=255*",
    "true", "false")

/* Branch 2: Known DNS OSINT tool names in process or command-line fields */
| eval tool_exec = if(
    raw_msg matches "*dnsrecon*" or raw_msg matches "*subfinder*" or
    raw_msg matches "*amass*" or raw_msg matches "*dnsenum*" or
    raw_msg matches "*fierce*" or raw_msg matches "*dnsmap*" or
    raw_msg matches "*gobuster*" or raw_msg matches "*altdns*" or
    raw_msg matches "*knockpy*" or raw_msg matches "*shuffledns*" or
    raw_msg matches "*puredns*" or raw_msg matches "*sublist3r*" or
    raw_msg matches "*dnstwist*",
    "true", "false")

/* Keep only events matching at least one branch */
| where zone_xfer = "true" or tool_exec = "true"

/* Extract source IP with fallback across common field label styles */
| parse regex field=raw_msg "(?i)(?:src_ip|src|source|client|ClientIP|clientip)[=:\s]+(?P<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" nodrop

/* Suppress zone transfer alerts originating from RFC1918 / loopback ranges */
| where not (zone_xfer = "true" and (
    src_ip matches "10.*" or src_ip matches "192.168.*" or
    src_ip matches "172.16.*" or src_ip matches "172.17.*" or
    src_ip matches "172.18.*" or src_ip matches "172.19.*" or
    src_ip matches "172.20.*" or src_ip matches "172.21.*" or
    src_ip matches "172.22.*" or src_ip matches "172.23.*" or
    src_ip matches "172.24.*" or src_ip matches "172.25.*" or
    src_ip matches "172.26.*" or src_ip matches "172.27.*" or
    src_ip matches "172.28.*" or src_ip matches "172.29.*" or
    src_ip matches "172.30.*" or src_ip matches "172.31.*" or
    src_ip matches "127.*" or src_ip matches "169.254.*"
  ))

/* Assign alert classification and risk score */
| eval AlertType = if(zone_xfer = "true",
    "External Zone Transfer Attempt",
    "DNS Enumeration Tool on Endpoint")
| eval RiskScore = if(zone_xfer = "true", 90, 60)

/* Extract device/host identifier across common log formats */
| parse regex field=raw_msg "(?i)(?:Computer|ComputerName|hostname|host|device)[=:\s]+(?P<device>[\w\-\.]+)" nodrop

| fields _messagetime, AlertType, RiskScore, device, src_ip, _sourceCategory, raw_msg
| sort by RiskScore desc, _messagetime desc