---
title: "Discussion on \"What's in a Name: DNS as a Detection Goldmine\" | Hashnode"
description: "Discussion on \"What's in a Name: DNS as a Detection Goldmine\". Why DNS is the highest-signal detection source most security teams under-use, and the practical detections you can build around it today."
url: "https://hashnode.com/posts/whats-in-a-name-dns-detection/69ca89355be5ef5cda8b146c"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [What's in a Name: DNS as a Detection Goldmine](https://www.hurrikane.net/whats-in-a-name-dns-detection?utm_source=hashnode&utm_medium=feed)

Why DNS is the highest-signal detection source most security teams under-use, and the practical detections you can build around it today.

Mar 30 · 10 min read · hurrikane.net  
Read the article

-   [#dns](https://hashnode.com/tag/dns)
-   [#detection-engineering](https://hashnode.com/tag/detection-engineering)
-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)
-   [#threatdetection](https://hashnode.com/tag/threatdetection)
-   [#threat-hunting](https://hashnode.com/tag/threat-hunting)

## Written by

[Brian Olson](https://hashnode.com/@brianolson)

@brianolson · Arlington, VA

  
[View profile](https://hashnode.com/@brianolson)

Cybersecurity pro & SANS instructor helping you level up in security, build wealth & optimize you daily life.

I’m Brian Olson, a cybersecurity professional with deep experience in DFIR and network forensics—currently working in Big Tech. My mission? To share hard-won lessons not just with fellow experts, but with anyone learning and growing in security—especially those in smaller companies without the resources or teams a massive enterprise has. I started blogging to break down real-world strategies, honest tool reviews, and battle-tested workflows in plain language. Whether you’re an underdog SOC analyst or a curious IT pro tackling security for the first time, my goal is to make the practical side of cybersecurity a little less overwhelming—and a lot more actionable. Expect guides that cut through the noise, resources that are actually useful at the keyboard, and stories that prove you don’t need a giant budget to make a real impact. You’ll also find my takes on personal finance, real estate, and anything that helps us level up—in and out of work. Let’s connect. We’re all in this together!

## Responses 1

Markdown supported · ⌘↵ to post

[Jacob Costa](https://hashnode.com/@jacob-costa)

[Apr 1](https://hashnode.com/posts/whats-in-a-name-dns-detection/69ca89355be5ef5cda8b146c/comment/69ccebc1b504c4ed0a666d90)

This is a really solid breakdown of DNS as a detection layer. A lot of teams still treat DNS as just infrastructure, but as you pointed out, it’s one of the richest sources of context across the entire attack lifecycle.

I especially liked the emphasis on “newly observed domains” over just newly registered ones. That shift toward environment-specific baselining is where detection maturity really starts to show. Also, the practical notes around Zeek and duplicate data sources are spot on, redundancy in visibility is often overlooked until it’s too late.

One thing I’d add from a process perspective is how important it is to track and validate these detection use cases over time. As environments evolve and noise patterns change, maintaining detection quality becomes just as important as building it. Using structured tracking with software test management tools like Tuskr ([https://tuskr.app/](https://tuskr.app/)) can actually help security teams treat detections like test cases, ensuring they stay relevant, tuned, and effective as part of a continuous improvement cy