View and investigate NXDOMAIN spikes

If an NXDOMAIN spike was detected in the last 24 hours, you can view and investigate these spikes from the Security Analytics page. To download a CSV that contains NXDOMAIN spike data, see Download CSV with data on NXDOMAIN spikes.

To view data on NXDOMAIN spikes:

1. From the Control Center menu, click Security > Security analytics > Infrastructure Security Analytics. The dashboard for Infrastructure Security Analytics appears.
2. To view data on NXDOMAIN spikes for a zone:
   1. In the Zone tab, go to a zone where NXDOMAIN spikes were detected. If you need to filter the list of zones, see Filter list of zones. You can also sort the list in the table to view the zones that have NXDOMAIN spike detection enabled.
   2. If NXDOMAIN spikes were found in the last 24 hours, a View button is visible in the NXDOMAIN Spike Detection column of the table. Click View. You can also go to the Actions menu and select NXDOMAIN Spikes.
      A window that details scan results appears. You can see the total number of requests and the number of requests that contained NXDOMAINs.
3. To view data on NXDOMAIN spikes for a shield:
   1. In the Shields tab, go to the shield where NXDOMAIN spikes were detected.
   2. If NXDOMAINs were found in the last 24 hours, a View button is visible in the NXDOMAIN Spike Detection column of the table. Click View. You can also go to the Actions menu and select NXDOMAIN Spikes.
      A window that details scan results appears. You can see the total number of requests and the number of these requests that contained NXDOMAINs.
4. To view data on NXDOMAIN spikes for a GTM domain:
   1. In the Domains tab, go to the GTM domain where NXDOMAIN spikes were detected.
   2. If NXDOMAINs were found in the last 24 hours, a View button is visible in the NXDOMAIN Spike Detection column of the table. Click View. You can also go to the Actions menu and select NXDOMAIN Spikes.
      A window that details scan results appears. You can see the total number of requests and the number of these requests that contained NXDOMAINs.
5. Expand a scan to view more details about the spike including the threshold that was exceeded and the number of average NXDOMAINs per second. You can click Investigate to view more data in a report. Note the following:
   • For an NXDOMAIN spike in a zone, you are directed to the Infrastructure Security Analytics - NXDOMAIN Spike Details report.
   • For an NXDOMAIN spike that occurred for a shield, you are directed to the Shield NS53 Proxy Queries report.

View date and time of last NXDOMAIN spike scan

Complete this procedure to view the date of the last NXDOMAIN spike scan.

To view date and time of last NXDOMAIN spikes:

1. From the Control Center menu, click Security > Security analytics > Infrastructure Security Analytics. The dashboard for Infrastructure Security Analytics appears.
2. Click the Zones, Shields, or Domains tab to view data on zones, shields, or GTM domains.
3. Sort results to show the zones, shields, or GTM domains that have NXDOMAINs spike detection enabled.
4. Expand the zone, shield, or GTM domain to see the date and time when the NXDOMAIN scan was completed. The page also indicates how long the last scan is current until another scan is run.