DNS Abuse Trend Intelligence Dashboard

Overview

End-to-end DNS threat detection pipeline built to demonstrate detection engineering and SIEM development in a Security Operations context. Generates high-volume synthetic DNS telemetry, runs behavioral detections across three threat categories, enriches matches against live open-source threat intelligence, and surfaces everything in a five-panel Splunk dashboard.

Pipeline

01generate_dns_logs.py→ 50,000 DNS events, today's timestamps

02Splunk ingest→ index: dns_logs · sourcetype: dns_custom

03detection_queries.spl→ fast-flux · DGA scoring · phishing candidates

04ioc_enrichment.py→ URLhaus + ThreatFox + OTX → 31,986 indicators

05dashboard.xml→ 5-panel Splunk Classic dashboard

Dashboard

DGA DETECTIONS OVER TIME

FAST FLUX DOMAINS

PHISHING CANDIDATES

Detection Logic

FAST-FLUX

Rapid IP Rotation Detection

Flags domains with high unique IP answer counts and low TTL variance across a rolling window — hallmark of botnet C2 and bulletproof hosting infrastructure.

T1568.001 · Fast Flux DNS
DGA

Algorithmic Domain Scoring

Entropy-based and n-gram heuristics surface algorithmically generated domains used by ransomware, banking trojans, and RATs for C2 resilience.

T1568.002 · Domain Generation Algorithms
PHISHING

Lookalike Domain Identification

Typosquatting, combosquatting, and subdomain abuse patterns targeting high-value brands, cross-referenced against live IOC lookup.

T1566.002 · Spearphishing Link

Threat Intel Feeds

Feed	Provider	IOCs	Type
URLhaus	abuse.ch	30,338	Malware distribution URLs
ThreatFox	abuse.ch	948	C2 indicators, malware IOCs
AlienVault OTX	AT&T Cybersecurity	700	Community threat pulses

NIST CSF Mapping

Panel	Function	Category
DGA Detections Over Time	Detect	DE.AE — Anomalies & Events
Fast Flux Domains	Detect	DE.CM — Continuous Monitoring
Phishing Candidates	Detect	DE.CM — Continuous Monitoring
IOC Matches	Identify	ID.RA — Risk Assessment
Top Suspicious Clients	Respond	RS.AN — Analysis

Author

Harsha Vardhan U S

MEng Cybersecurity · University of Maryland, College Park
Targeting: Security Operations · Detection Engineering

GitHub LinkedIn