Skip to main content


This view provides raw historic data about DNS queries.

Lacework regularly monitors for DNS queries in your environment and returns a row in the DNS_QUERY_V view when Lacework detects a DNS query.

Each row contains DNS Query information as listed in the columns.

Column NameData TypeDescription
CREATED_TIMETimestampThe time and date when the DNS query was detected by Lacework.
MIDNumberThe Lacework-generated machine identifier of the machine that generated the query.
FQDNTextThe fully qualified domain name of DNS server.
HOST_IP_ADDRTextThe IP address of the machine that generated the query.
TTLNumberThe time to live for the DNS query before the query expires.
DNS_SERVER_IPTextThe resulting IP address of the DNS query.