Skip to main content
Version: 0.2.0

Dns query

This event is generated when the a DNS response is received on the host and gives insight both on the query, the response and the DNS resolver.


This event will be generated only for DNS over UDP/53 or TCP/53


The code responsible of generating this event is one of the most complex so it is possible that some edge cases might not generate the expected event. If that is your case, open an issue, we will work on it.

"data": {
"ancestors": "/usr/lib/systemd/systemd|/usr/bin/login|/usr/bin/zsh|/usr/bin/bash|/usr/bin/xinit|/usr/bin/i3|/usr/bin/bash|/usr/bin/urxvt|/usr/bin/zsh|/usr/bin/bash",
"command_line": "curl",
"exe": {
"file": "/usr/bin/curl"
"query": "",
"proto": "udp",
"response": ";;;",
"dns_server": {
"ip": "",
"port": 53,
"public": false,
"is_v6": false
"info": {
"host": "...",
"event": {
"source": "kunai",
"id": 61,
"name": "dns_query",
"uuid": "6c106f3d-cf35-8e27-2f21-24ff6e505fae",
"batch": 67
"task": "...",
"parent_task": "...",
"utc_time": "2024-02-12T21:58:23.240891687Z"