SECURITY-OPERATIONS-SOC5 MIN READ
Decide: DNS Exfiltration Signal
Choose a response to suspected DNS tunneling that balances containment and confirmation.
The signal is not proof of data loss, but it may represent a late-stage channel. The response should interrupt the channel, preserve evidence, and scope data access before making claims.
Read the full lesson
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in