Analytics
This category contains various statistics from resolvers, passive DNS, and data from Cesnet Warden.
Statistics
In this section, you can view statistics and graphs related to the application’s operation.
You can set the parameters for the displayed graphs (Step (Day, Hour, Minute), Time Range (From Date - To Date), Resolver, Domain, IP, Subnet, Country) at the top of the page. You can show or hide the filters by clicking the corresponding text Show Filters or Hide Filters next to the section title.
The set of visible tiles can be customised through the Manage button next to the section title.
- Query Count - The development of the number of DNS queries processed by the application.
- QType Over Time - The development of DNS queries, distinguishable by their type (e.g., A, NS, SOA, etc.). You can toggle the visibility of individual types on or off by clicking their name in the legend on the right side of the graph.
- Top Domains - A ranking of domains sorted by the frequency with which the application processed them. The total number of queries is listed for each domain.
- Top Sources - A ranking of source IP addresses sorted by the frequency with which they generated DNS queries. The total number of queries is listed for each IP address.
- Top Servers - A ranking of resolvers/servers sorted by the total number of DNS queries they processed. It shows which ones carried the heaviest load.
- Country Distribution - A world heatmap illustrating the geographical distribution of DNS queries. Color intensity corresponds to the total number of queries originating from the given country. The exact value for a specific country will be displayed when you hover the mouse cursor over the area.
- QType RCode Matrix - Display of the distribution of DNS query types (QType) by the return codes (RCode) the queries received after processing. The graph is used for visual assessment of whether the given query types (e.g., A, AAAA, MX, etc.) return with the expected result (NOERROR) or encounter errors such as SERVFAIL (server failure), NXDOMAIN (domain does not exist), REFUSED (query rejected), or NOTIMP (requested function is not supported). The count of individual query types within the given RCode will be displayed when you hover the mouse cursor over the respective column. You can toggle the visibility of QTypes on or off by clicking their name in the legend on the right side of the graph.
- RCode Distribution Over Time - The graph visualizes the simultaneous development of the frequency of individual return codes. You can toggle the visibility of individual return codes on or off by clicking their name in the legend on the right side of the graph.
- Policy Actions - A pie chart illustrating the overall distribution of DNS queries according to the action applied by the configured rule sets. The graph serves to assess what proportion of queries are PASS (allowed), BLOCK (blocked), or AUDIT (allowed and monitored). Exact numerical values will be displayed when you hover the mouse cursor over the respective slice.
- Policy Actions by Rule - A stacked bar chart showing which specific rule sets contribute to the final action taken on the query (PASS, BLOCK, AUDIT). The graph is used for visual assessment of the effectiveness and engagement of individual rules. You can toggle the visibility of individual rules on or off by clicking their name in the legend on the right side of the graph. The exact count of queries for specific rules within the given action will be displayed when you hover the mouse cursor over the respective column.
- QType Distribution - A pie chart illustrating the overall distribution of DNS queries according to their type. Exact numerical values will be displayed when you hover the mouse cursor over the respective slice.
- QPS by Server - Visualization of the simultaneous development of load on individual resolvers/servers, measured in Queries Per Second (QPS). You can toggle the visibility of individual servers on or off by clicking their name in the legend.
- NXDomain Over Time - The development of the count of queries ending with the NXDOMAIN error (domain does not exist).
- ServFail Over Time - The development of the count of queries ending with the SERVFAIL error (server failure/unsuccessful processing).
- Domain in Rule Sets - Shows the Rule Sets that contain the filtered domain.
Logs history
This section allows you to obtain archival queries using filtering.
Searching works in basic and advanced modes. Basic mode allows filtering (with logical operators) and sorting, while advanced mode also supports aggregation and filtering within them. In the query builder, you can create the desired query and set a limit on the number of results. Results that meet the conditions are then displayed in the table below. Advanced mode can be enabled using the switch in the upper right corner of the screen.
Select field (advanced mode)
Specifies which columns are displayed in the table. In default mode, this field is not visible and all available columns are displayed. In SQL, this corresponds to the expression SELECT [selection].
Aggregations (advanced mode)
Aggregations calculate a single summary value from several records (often defined in Group by) and store this value in a new field. Aggregations can be defined by a field and a function, and an alias can then be defined for this newly created field.
Aggregation can only be performed on selected fields (defined in Select Field).
| Aggregation | Function |
|---|---|
COUNT | Counts how many records contain a non-zero value in the field (supports wildcard *) |
SUM | Adds up the numeric values in the field across all records (available only for numeric fields) |
AVG | Calculates the average value of the field across all records (available only for numeric fields) |
MIN | Finds the smallest value in the field across all records (works for both numbers and strings) |
MAX | Finds the largest value in the field across all records (works for both numbers and strings) |
COUNT DISTINCT | Counts how many unique non-zero records are in the field |
MEDIAN | Calculates the median (middle value) across all records (available only for numeric fields) |
STDDEV_POP | Calculates the population standard deviation - the measure of dispersion of numeric values |
TO_START_OF_MINUTE | Groups the results of other defined aggregations by minutes |
TO_START_OF_HOUR | Groups the results of other defined aggregations by hours |
TO_START_OF_DAY | Groups the results of other defined aggregations by days |
TO_START_OF_WEEK | Groups the results of other defined aggregations by week |
TO_START_OF_MONTH | Groups the results of other defined aggregations by month |
TO_START_OF_QUARTER | Groups the results of other defined aggregations by quarter |
TO_START_OF_YEAR | Groups the results of other defined aggregations by year |
TO_START_OF_FIVE_MINUTES | Groups the results of other defined aggregations by five minutes |
TO_START_OF_TEN_MINUTES | Groups the results of other defined aggregations by ten minutes |
TO_START_OF_FIFTEEN_MINUTES | Groups the results of other defined aggregations by fifteen minutes |
Aggregations are not available in default mode.
Conditions
Conditions are applied to each record before aggregation (if applied). A condition can be applied to any item in the record. When you click on the plus icon -> add condition, select the field, operator, and value. The selection of the operator is determined by the type of the field; for example, a number field can be filtered using mathematical operators such as less than/greater than, etc., and a string field can be filtered using the contains operator, etc. Fields can always be filtered using the operators Equals, Not equals, Is null (is empty), and Is not null (is not empty). In SQL, this corresponds to the expression WHERE.
Individual conditions can be grouped using groups. A group can be created by clicking on the plus icon -> add group. A group can contain other nested groups or conditions. Conditions/groups can then be combined using logical connectors AND/OR (and/or), which appear after adding two or more conditions/groups. The logical connector AND takes precedence over OR.
| Filter | Function |
|---|---|
Equals | Equality |
Not equals | Inequality |
Greater than or equal | Greater than or equal to (for numeric values) |
Less than or equal | Less than or equal to (for numeric values) |
Greater than | Greater than (for numeric values) |
Less than | Less than (for numeric values) |
In list | Present in the list of values |
Not in list | Not present in the list of values |
Contains | Contains (for text values; on IP fields, performs a substring match without IP validation) |
Does not contain | Does not contain (for text values; on IP fields, performs a substring match without IP validation) |
Starts with | Begins with the given prefix (for text values) |
Ends with | Ends with the given suffix (for text values) |
Is null | Is an empty value |
Is not null | Is not an empty value |
Some fields offer only a subset of these operators. Country accepts only Equals, Not equals, Is null, and Is not null. The IP source fields (Source IPv4, Source IPv6) accept only the equality, comparison, and list operators. The User and Device fields open a modal table from which one or more entities can be selected as the condition value; their button shows how many items are currently selected.
The date/time condition supports second-level granularity.
Group by (advanced mode)
Grouping combines records into groups where the specified field has the same value. Only fields that are selected (in Select fields) or created in Aggregation can be selected. Additional filters can be applied to these groups in Having.
Having (advanced mode)
Having applies conditions to the grouping created in Group by, unlike Conditions, which are applied earlier and for each record.
Filters are created similarly to Conditions, with the difference that only fields defined in Aggregation or Group by can be selected.
Sort by
Specifies the value by which to sort the results. After selecting a field, click the button next to the field name to select descending/ascending sorting.
If the user has applied the selected fields (SELECT) in advanced mode, filtering is only possible by these selected fields.
Search display
Displays the created query in a format similar to SQL. It serves illustrative purposes only; the actual query looks different (in reality, the executed query is more complex because, among other things, the access rights of the querying user are also applied to it).
Limit, saving queries, and search
In the lower right corner of the screen, you can apply a limit, i.e., how many results will be retrieved from the database and displayed. Using the ‘Export JSON’ button, you can download the current query as a file. It can be reused later by uploading it using the ‘Import JSON’ button.
In the lower left corner, you will find the Search button, which starts the search, and the Reset button, which clears the current query and returns the search to its default state.
Favorite queries
A query you use repeatedly can be saved. The heart button in the query builder header opens the favorite queries window, where the current query is saved under a name and an optional description.
The following actions are available for each saved query:
| Action | Description |
|---|---|
| Apply | Loads the saved query into the builder |
| Update with current query | Overwrites the saved query with whatever is currently in the builder |
| Share | Opens the window for granting other users permissions to the query |
| Delete | Removes the saved query |
The name of the active favorite query is shown on the heart button itself; it can be renamed with the pencil icon next to the name. If the query in the builder differs from the saved version, it is marked with an asterisk as unsaved changes, which can either be saved or discarded by reloading the saved version.
If someone else edits a saved query in the meantime, the portal points it out and lists which parts changed. Your unsaved changes are kept.
Next to the favorite queries button is the Reset query button, which returns the builder to its default state.
Sharing by link
The page address always carries the current query and the list of displayed columns. Copying the address from the browser therefore sends a colleague exactly what you have on screen; opening the link loads the query into the builder. For very large queries the link may get too long, in which case it is better to save the query as a favorite and share that.
Record history table
After running the filtering using the Search button, the results are displayed in the table at the bottom of the page. You can switch pages in the table if there are more results than the limit. Results can also be exported to a CSV file.
Above the table there are buttons for the column visibility settings and for switching the table to fullscreen. Fullscreen is left with the same button or with the Esc key. Adding a column fetches the data it needs on its own, there is no need to run the search again.
Cell context menu
Right-clicking any cell in the results opens a menu with the following options:
| Option | Description |
|---|---|
| Equals | Adds a condition on the cell value to the builder |
| Not equals | Adds a condition excluding the cell value to the builder |
| Copy value | Copies the cell value to the clipboard |
| Open user details | Opens the user page from that row in a new tab (user column only) |
| Add domain to ruleset | Adds the domain from that row to a selected rule set (only when the domain column is shown) |
The condition is added with an operator the given field supports; for an empty cell the first two options are replaced by Is null and Is not null. The builder updates immediately, the search then has to be run with the Search button.
Examples of complete queries
This query will display 500 (not necessarily the last) records with querying IP addresses in the specified range.
SELECT *WHERE Source IPv4 >= '192.168.0.0' AND Source IPv4 >= '220.0.0.0'LIMIT 500;This query will display the last date and time, DNS query name, and the number of unique clients from 100 records that meet the time inequality (at the time of writing, last week) and that, after grouping, have at least 10 unique querying clients. These records will be sorted in descending order by the number of queries.
SELECT MAX(Date and time (local)) AS last_seen, COUNTDISTINCT(Source IP (unified)) AS unique_clients, DNS query nameWHERE Date and time (local) >= 1762167600GROUP BY DNS query nameHAVING unique_clients > 10ORDER BY unique_clients DESCLIMIT 100;Passive DNS
This section is used to track the history of DNS record changes. In the upper right corner, you can enter the desired domain along with the record type. The corresponding results will be displayed in the table:
| Item | Description |
|---|---|
| Record name | Domain searched |
| Record type | DNS record type |
| Response data | Corresponding record data |
| First sighting | This record was first sighted at this time |
| Last sighting | This record was last seen at this time |
| Count | Indicates how many times the resolver captured this record in DNS responses during the given time interval |
Files
In the Files section, you can download lists of suspicious IP addresses from the Cesnet Warden project. These lists can then be used, for example, in a firewall.
| Item | Description |
|---|---|
| File name | File name |
| Size | File size |
| Last modified | Time of last file modification |
| Action | Button to download the file |