create azure analytic rule for discovering any dangling DNS records
Budget: $30 – $250 USD
Hi
In order to prevent dangling DNS entries and avoid subdomain takeover
I am looking for some to write an Azure analytic to run every few hours and scan tenants to see if there are any dangling DNS issues. Following the links below.
If there are any identified entries, the analytic rule is to capture those in the sentinel query and output the full details
Identify dangling DNS entries
To identify DNS entries within your organization that might be dangling, use Microsoft's GitHub-hosted PowerShell tools "Get-DanglingDnsRecords".
This tool helps Azure customers list all domains with a CNAME associated to an existing Azure resource that was created on their subscriptions or tenants.
If your CNAMEs are in other DNS services and point to Azure resources, provide the CNAMEs in an input file to the tool.
The tool supports the Azure resources listed in the following table. The tool extracts, or takes as inputs, all the tenant's CNAMEs.
https://github.com/Azure/Azure-Network-Security/tree/master/Cross%20Product/DNS%20-%20Find%20Dangling%20DNS%20Records
and
https://learn.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover
I would also like a visio diagram to describe with a workflow / playbook how this analytic works
In order to prevent dangling DNS entries and avoid subdomain takeover
I am looking for some to write an Azure analytic to run every few hours and scan tenants to see if there are any dangling DNS issues. Following the links below.
If there are any identified entries, the analytic rule is to capture those in the sentinel query and output the full details
Identify dangling DNS entries
To identify DNS entries within your organization that might be dangling, use Microsoft's GitHub-hosted PowerShell tools "Get-DanglingDnsRecords".
This tool helps Azure customers list all domains with a CNAME associated to an existing Azure resource that was created on their subscriptions or tenants.
If your CNAMEs are in other DNS services and point to Azure resources, provide the CNAMEs in an input file to the tool.
The tool supports the Azure resources listed in the following table. The tool extracts, or takes as inputs, all the tenant's CNAMEs.
https://github.com/Azure/Azure-Network-Security/tree/master/Cross%20Product/DNS%20-%20Find%20Dangling%20DNS%20Records
and
https://learn.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover
I would also like a visio diagram to describe with a workflow / playbook how this analytic works