Sample Agent report: suspicious DNS exfiltration
Representative Agent Pro output for a DNS tunneling investigation, with reproducible packet evidence anchors.
Reproducible packet references
104-388
Long encoded TXT queries
Repeated long labels from one client to one domain suggest staged data transfer over DNS.
dns.qry.type == 16 && dns.qry.name contains "example"112-402
Low-value responses
Responses remain small while outbound query volume stays high.
dns.flags.response == 1 && ip.addr == 10.12.4.18221-244
Retry pattern
Client retries preserve the same encoded label shape during resolver delay.
dns.retransmission || dns.time > 1Executive Summary
This sample Agent report shows a likely DNS tunneling case. The strongest evidence is not the presence of DNS alone; it is the combination of long encoded labels, repeated TXT queries, low-value responses, and steady client retries.
Findings
- The client sends high-volume TXT queries with labels that look encoded rather than human-readable.
- Responses are small and do not explain the outbound byte volume.
- Timing remains steady enough to look like staged transfer instead of normal resolver noise.
Recommended Actions
Block or sinkhole the suspect domain while the endpoint is inspected. Preserve the original capture, export resolver logs for the same time window, and compare host process telemetry for DNS client activity.
Evidence Anchors
| Anchor | Packet evidence | Reproduce |
|---|---|---|
| DNS-1 | Frames 104-388 show repeated long TXT queries from one client. | dns.qry.type == 16 && dns.qry.name contains "example" |
| DNS-2 | Frames 112-402 show low response payload relative to outbound query volume. | dns.flags.response == 1 && ip.addr == 10.12.4.18 |
| DNS-3 | Frames 221-244 show retry behavior around delayed responses. | `dns.retransmission |
Buyer Note
This is a public sample report. It demonstrates the output structure buyers should expect from Agent Pro: clear finding, confidence boundary, and packet-level anchors another analyst can reproduce.