---
title: "DNS Security Events Configuration Variables"
canonical: "https://docs.infoblox.com/space/DeploymentGuideTDwDDIforSplunkSOAR/1688600667/DNS%20Security%20Events%20Configuration%20Variables"
format: markdown
---
### Parameters (Optional)

| **Parameter** | **Description** |
| --- | --- |
| Max Hours Backwards | Number of hours before the first connector iteration to retrieve alerts from (integer, default: 0). |
| Queried name | Filter by comma-separated queried domain names (string list). |
| Policy Name | Filter by comma-separated security policy names (string list). |
| Threat Level | Filter by threat severity level (LOW, MEDIUM, HIGH) (string). |
| Threat Class | Filter by comma-separated threat category (e.g., "Malware", "MalwareDownload") (string list). |
| Threat Family | Filter by comma-separated threat family (e.g., Log4Shell, OPENRESOLVER) (string). |
| Threat Indicator | Filter by comma-separated threat indicators (domains, IPs) (string list). |
| Policy Action | Filter by comma-separated action performed (Log, Block, Default, Redirect) (string list). |
| Feed Name | Filter by comma-separated threat feed or custom list name (string list). |
| Network | Filter by comma-separated network name, on-premises host, endpoint, or DFP name (string list). |
| Limit | Maximum number of records to retrieve per polling cycle (integer, default: 100). |

### **Severity Mapping of DNS Security Events**

| **Threat Level** | **SOAR Container Severity** |
| --- | --- |
| HIGH | High |
| MEDIUM | Medium |
| LOW | Low |
| INFO | Low |

### **Container Creation**

Each DNS Security Event will create a separate container in Splunk SOAR with relevant metadata and artifacts containing the event details.

### **Important API Limitation**

The DNS Security Events API does not support sorting, and records are returned in descending order by default. This may result in data loss if there are more records than the specified limit. To minimize this risk, apply relevant filters and adjust the limit parameter appropriately.