Zscaler ZIA DNS - Suspected DNS Tunneling

KQL Cowboy@KQLCowboy

•updated Aug 18, 2026•1•0•6

This rule identifies potential DNS tunneling or exfiltration attempts by monitoring for high volumes of DNS queries, a high count of distinct subdomains, or the usage of unusual DNS record types (TXT, NULL) within Zscaler Internet Access logs.