DNS filtering and events

DNS filtering and events is a logging mechanism that

  • generates connection events using specific fields such as DNS Query, URL Category, URL Reputation, and Destination Port,

  • populates the DNS Query field with the domain name while leaving the URL field blank for DNS filtering matches, and

  • sets the Destination Port to 53.

Event generation behavior

DNS filtering generates events based on the access control rule action:

  • When the access control rule action is Allow or Trust, two connection events will be generated for the same traffic, one for DNS filtering (with the DNS Query field populated) and one for URL filtering (with the URL field populated).

  • The first time the system encounters a particular URL, two events appear for that single session: one event showing uncategorized or reputationless for the DNS Query, and one event showing the actual category and reputation for the URL, which the system retrieves during the DNS Query and applies to the session while processing using standard URL filtering.