DNS Resolvers
Overview
Evidence: DNS Resolvers
Description: Collect DNS Resolvers
Category: Network
Platform: macos
Short Name: dnsr
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
This collector gathers DNS resolver configuration from macOS. This data is essential for understanding name resolution paths, detecting DNS-based attacks, and investigating connectivity issues.
Data Collected
This collector gathers structured data about dns resolvers.
DNS Resolvers Data
| Field | Description | Example |
|---|---|---|
AddressTypeIndex | Address Type Index | 123 |
AddressType | Address Type | Example value |
Address | Address | Example value |
NetMask | Net Mask | Example value |
Options | Options | 123 |
Collection Method
This collector queries the dns_resolvers table via osquery and records results into the dns_resolvers table.
Forensic Value
This evidence is crucial for forensic investigations as it reveals DNS servers, netmask/search configuration, and options that can indicate misconfigurations or malicious redirection.