How do I tell which user clicked the dodgy link?

stuart_seedstuart_seed
in DNSWatch - Product Enhancements

We have DNSWatch protecting the network, but when I see an alert for a phishing link clicked in DNSWatch it only shows my external IP from the firewall. So I search the firewall logs for the dodgy domain, or the landing page or any reference to DNSWatch and find nothing so I have no idea who to speak to about clicking on suspect links? Any advice?

Comments

  • shaazaminatorshaazaminator

    Noticed the same thing. Sorta hoped I would see user@domain.com since everything is SSO and AD integrated. At least an internal IP would be nice, but no dice.

    It's usually something simple.

  • Bruce_BriggsBruce_Briggs

    The issue is the DNS request packet heading to the DNSWatch DNS server comes from the external interface of the firewall.
    So the DNSWatch DNS server has no information about the real source of the DNS packet - the internal IP addr, user, etc.

    However, it would seem that the DNSWatch process in XTM could be set up to log info related to the block, so that we could see it in Traffic Monitor & Dimension.

  • greggmh123greggmh123

    The only thing I can think of that would get you anywhere remotely close is the timestamp of the DNSWatch hit and looking backwards a few seconds before that time. That may not be fun if you have a lot of web traffic.

    Gregg Hill

  • xxupxxup

    Been there - done that... What was also useful was tracking through the browser history - made somewhat easier by the use of roaming profiles..

    Adrian from Australia

  • Tristan.ColoTristan.Colo

    Does DNSWatch GO do a good job at logging this for clients?

  • ConnectNowConnectNow

    @Bruce_Briggs said:
    The issue is the DNS request packet heading to the DNSWatch DNS server comes from the external interface of the firewall.
    So the DNSWatch DNS server has no information about the real source of the DNS packet - the internal IP addr, user, etc.

    However, it would seem that the DNSWatch process in XTM could be set up to log info related to the block, so that we could see it in Traffic Monitor & Dimension.

    if you get a warning the client pc has hit the dnsWatch block page. that is where dnsWatch can read the the hostname and local ip address of the device that visite the blocked site

Sign In to comment.