The appropriate analytic is Excessive DNS Failures . The decisive evidence in the example is the DNS query followed by a SERVFAIL response. SERVFAIL is a DNS response condition indicating that the DNS server was unable to complete the requested resolution successfully. Repeated occurrences therefore represent DNS-resolution failures rather than authentication, endpoint, or generic network failures.
A detection engineer could aggregate these events across an appropriate time window and evaluate dimensions such as source host, queried domain, client, or response code. The objective is to distinguish ordinary occasional resolution failures from anomalous concentrations that warrant investigation.
The example is particularly security-relevant because the queried name resembles a command-and-control domain. However, the detection name requested by the question is driven by the observable pattern in the telemetry: repeated failed DNS resolutions. Such activity can result from misconfiguration, unavailable authoritative infrastructure, transient DNS problems, or suspicious software repeatedly attempting to resolve unavailable infrastructure. Analysts would use additional context to determine the actual cause.
None of the other options corresponds directly to the DNS SERVFAIL evidence shown in the event.
Study Guide topics: DNS telemetry, SERVFAIL, threshold-based detections, network security monitoring, DNS analytics, detection operationalization.
