In cybersecurity, passive DNS is used for detecting malicious activities like domain hijacking and botnets. It stores historical DNS information and provides insights into domain names and IP addresses. Passive DNS solutions enhance security posture and protect against emerging threats.
Passive DNS derives from collecting DNS query information in a database via network sniffing. While traditional DNS records are transient, passive DNS stores a collection and archive of historical DNS records. This contains a wealth of information about DNS queries on the Internet. Analysis of passive DNS data is used for insights into old DNS records, new values, and differences; it can also find possible attack vectors.
An attacker or defender with this information can see where, how, and when your organization’s domain names and IP addresses have changed over time and who is changing them.
See Also
Platform > Features
A dynamic asset inventory, built using natural language processing and advanced analysis of open source intelligence (OSINT), at your fingertips.
Platform > Features
CyCognito automatically classifies your attack surface assets by business context and relationship to your organization. Act with knowledge and confidence.
Resources > Datasheets
Learn how you can uncover your full organizational structure with high accuracy, enterprise scale, details, and evidence so that you can properly understand who owns and manages each digital asset exposed to the internet.
Resources > Solution Briefs
Download this brief to learn about the common problems that exist today within asset discovery and contextualization and how CyCognito can be implemented as a solution.