About the DNS Query Extension Plugin

The DNS Query Extension plugin is an internal component of the Forescout eyeSight (formerly Forescout Platform or CounterAct) that provides a service for various features in the product.

The plugin is a component of the eyeSight Core Extensions Module.

In addition, it provides stand-alone features that:

• Determine whether a given endpoint in the network is a DNS server.
• Check DNS lookups of specific domain names performed by network endpoints. For example, it can detect endpoints that browsed to a specific website, and then it can trigger an action to block those endpoints.

The DNS Query Extension sees traffic via the SPAN port. It detects and parses DNS messages in the network that reference specific host names. It does not report other DNS interactions.

This extension provides host properties in the Device Information folder. See Detecting Endpoints – DNS Query Properties.

We now have IPv6 support with the DNS Query Extension plugin.