DNS Resolvers
Overview
Section titled “Overview”Evidence: DNS Resolvers
Description: Collect DNS Resolvers
Category: Network
Platform: macos
Short Name: dnsr
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”This collector gathers DNS resolver configuration from macOS. This data is essential for understanding name resolution paths, detecting DNS-based attacks, and investigating connectivity issues.
Data Collected
Section titled “Data Collected”This collector gathers structured data about dns resolvers.
DNS Resolvers Data
Section titled “DNS Resolvers Data”| Field | Description | Example |
|---|---|---|
AddressTypeIndex | Address Type Index | 123 |
AddressType | Address Type | Example value |
Address | Address | Example value |
NetMask | Net Mask | Example value |
Options | Options | 123 |
Collection Method
Section titled “Collection Method”This collector queries the dns_resolvers table via osquery and records results into the dns_resolvers table.
Forensic Value
Section titled “Forensic Value”This evidence is crucial for forensic investigations as it reveals DNS servers, netmask/search configuration, and options that can indicate misconfigurations or malicious redirection.