As cited
Copy frozen at (site build).
Detect domain generation algorithm (DGA) activity with new Kibana integration
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Detect domain generation algorithm (DGA) activity with new Kibana integration
Elastic released a domain generation algorithm (DGA) detection package available in Kibana's Integrations app that includes a supervised machine learning model, ingest pipelines, anomaly detection jobs, and detection rules to identify malware command and control communications. The package analyzes DNS events, enriches them with DGA scores, and flags suspicious patterns of domain queries from individual source IP addresses. Users can install the package in a single click and configure it to work with DNS event data from tools like Packetbeat.
Why it matters: Security teams defending networks against malware that uses DGA evasion techniques can now deploy automated detection in minutes using pre-built Elastic assets, reducing the time to identify infected clients attempting to reach command and control servers.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Detect domain generation algorithm (DGA) activity with new Kibana integration
Elastic released a domain generation algorithm (DGA) detection package available in Kibana's Integrations app that includes a supervised machine learning model, ingest pipelines, anomaly detection jobs, and detection rules to identify malware command and control communications. The package analyzes DNS events, enriches them with DGA scores, and flags suspicious patterns of domain queries from individual source IP addresses. Users can install the package in a single click and configure it to work with DNS event data from tools like Packetbeat.
Why it matters: Security teams defending networks against malware that uses DGA evasion techniques can now deploy automated detection in minutes using pre-built Elastic assets, reducing the time to identify infected clients attempting to reach command and control servers.
- Source published
- First seen by Cybersecurity Tracker