Sample Agent report: suspicious DNS exfiltration

Executive Summary

This sample Agent report shows a likely DNS tunneling case. The strongest evidence is not the presence of DNS alone; it is the combination of long encoded labels, repeated TXT queries, low-value responses, and steady client retries.

Findings

1. The client sends high-volume TXT queries with labels that look encoded rather than human-readable.
2. Responses are small and do not explain the outbound byte volume.
3. Timing remains steady enough to look like staged transfer instead of normal resolver noise.

Recommended Actions

Block or sinkhole the suspect domain while the endpoint is inspected. Preserve the original capture, export resolver logs for the same time window, and compare host process telemetry for DNS client activity.

Evidence Anchors

Buyer Note

This is a public sample report. It demonstrates the output structure buyers should expect from Agent Pro: clear finding, confidence boundary, and packet-level anchors another analyst can reproduce.