Enable and configure NXDOMAIN spike detection

Complete this procedure to enable NXDOMAIN spike detection.

📘

If you configured default NXDOMAIN spike thresholds, the threshold settings you set with this procedure take precedence over the default settings.

Before you begin:

Make sure you apply general settings. For instructions, see Apply general settings.

To enable NXDOMAIN spike detection:

1. From the Control Center menu, click Security > Security analytics > Infrastructure Security Analytics. The dashboard for Infrastructure Security Analytics appears.
2. If you are enabling NXDOMAIN spike detection in a zone, complete these steps:
   1. Go to the zone where you want to enable NXDOMAIN spike detection. If you need to apply a filter to find a zone, see Filter list of zones.
   2. From the Actions menu, select Zone Settings.
   3. In the window that appears, click the NXDOMAIN Spikes tab, and go to step 5.
3. If you are enabling NXDOMAIN spike detection for a shield, complete these steps:
   1. Go to the shield configuration for which you want to enable NXDOMAIN spike detection.
   2. From the Actions menu, select Shield Settings.
   3. In the window that appears, click the NXDOMAIN Spikes tab, and go to step 5.
4. If you are enabling NXDOMAIN spike detection for a GTM domain, complete these steps:
   1. Go to the GTM domain for which you want to enable NXDOMAIN spike detection.
   2. From the Actions menu, select Domain Settings.
   3. In the window that appears, click the NXDOMAIN Spikes tab, and go to step 5
5. Enable the toggle for NXDOMAIN Spike Detection.
6. In the Threshold Type menu, select whether you want to apply a dynamic or absolute threshold. Based on the threshold type you select, do one of the following:
   • In the Dynamic Threshold field, enter a z-score or standard score value that must be met for traffic to be considered part of an NXDOMAIN spike.
   • In the Absolute Threshold field, enter a value for NXDOMAIN responses per second.
7. Set an expiration date for the NXDOMAIN spike settings. Click the date and select an expiration date from the calendar. Make sure you also set a time of day and a time zone. You can set a date up to one year in the future.
   If you also enabled dangling CNAME detection or DNS hijacking detection, this expiration date also applies to those settings.
8. Click Confirm.