[Autogenerated] As an incident responder,
the next step would be trying to decode the information
contained within those subdomains.
However,
this can be complex if not impossible depending on how the C two
server is sending and receiving information.
This demonstrates a real world example on how to detect
malicious subdomain traffic in DNS.
For this demo, the analysis using Zeek on the command line is a bit more complex,
requiring more advanced Linux commands and experience.
However, in a typical enterprise environment,
the use of a visualization tool should make sorting and
extracting the data much simpler.
I also raised the bar pretty quick by using this as a final example.
Despite this being more of a foundational level course,
I wanted to introduce a more advanced example of an attack and analysis.
I hope you'll forgive me for that.
And don't worry if you struggled to understand some of the
components from that last demo as a whole.
This course should have provided you with a much better understanding
of the DNS protocol from that security perspective.
Thanks again for joining me and I hope to see you again next time.