Event reference

Field reference for query events, the CEF export format, and webhook payloads.

Query event fields

action is the decision and reason is its basis. dns_q.event is "new" the first time a policy resolves a name. dns_q.rank is an establishment measure derived from the global DNS graph; a name with no inbound references has no rank.

Field	Type	Meaning
@timestamp	date	When the resolver answered
action	keyword	accept, block, threat, or greywall
reason	keyword	Why: policy, category, blacklist, whitelist, first-seen, feed
rcode	keyword	DNS response code returned to the client
client.ip	ip	Source address of the query
server.mobile	keyword	Virtual site (DoH) address, when the query arrived over DoH
server.mobile_name	keyword	Virtual site display name
dns_q.name	keyword	Queried hostname
dns_q.domain	keyword	Registrable domain of the query
dns_q.type	keyword	Record type: A, AAAA, HTTPS, TXT, and so on
dns_q.protocol	keyword	udp, tcp, or doh
dns_q.categories	keyword[]	Content and security categories matched
dns_q.event	keyword	"new" when the policy resolved the name for the first time
dns_q.rank	integer	Establishment measure derived from the global DNS graph. Names with no inbound references have no rank
dns_a.data	keyword	Answer data returned
dns_a.rcode_name	keyword	NOERROR, NXDOMAIN, SERVFAIL, and so on
dns_a_ip.as	integer	ASN of the answered address
dns_a_ip.asname	keyword	AS organization name
dns_a_ip.country	keyword	Country of the answered address
threat_info.categories	keyword[]	Threat categories from feeds, when matched

Sample event (JSON export)

event.json

{
  "@timestamp": "2026-09-12T14:03:05.221Z",
  "action": "greywall",
  "reason": "first-seen",
  "rcode": "NOERROR",
  "client": { "ip": "10.40.3.17" },
  "server": { "mobile": "", "mobile_name": "" },
  "dns_q": {
    "name": "api.newai-svc.xyz",
    "domain": "newai-svc.xyz",
    "type": "A",
    "protocol": "udp",
    "categories": [],
    "event": "new",
    "rank": null
  },
  "dns_a": { "data": "<block page address>", "rcode_name": "NOERROR" },
  "threat_info": { "categories": [] }
}

CEF line (as exported)

securd.cef

CEF:0|Securd|DNS|2.0|{action}|{dns_q.name}|{severity}|src={client.ip} dhost={dns_q.name} cat={category} reason={reason}

# severity: accept 1, greywall 5, block 7, threat 9, anything else 3
CEF:0|Securd|DNS|2.0|greywall|api.newai-svc.xyz|5|src=10.40.3.17 dhost=api.newai-svc.xyz cat= reason=first-seen

Webhook events

Each delivery is a JSON body with event, timestamp and data fields, signed with HMAC-SHA256 over the raw body in the X-Securd-Signature header. Delivery is attempted three times with backoff. Receivers should verify the signature before processing.

envelope

{
  "event": "<event type>",
  "timestamp": "2026-09-12T14:03:11.412000+00:00",
  "data": { ... }
}

verify.py

import hmac, hashlib
def verify(secret: str, raw_body: bytes, header: str) -> bool:
    expected = "sha256=" + hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header or "")

threat.detected

A query in the last minute matched a threat feed or threat category. One event per distinct hostname and client address per window. event_id supports receiver-side deduplication.

threat.detected

{
  "event": "threat.detected",
  "timestamp": "2026-09-12T14:03:11.412000+00:00",
  "data": {
    "event_id": "9f1c2a7d3b4e5f60718293a4",
    "domain": "exfil-data.click",
    "registrable_domain": "exfil-data.click",
    "client_ip": "10.40.3.17",
    "action": "block",
    "categories": ["malware"],
    "site_name": "research-vpc",
    "occurred_at": "2026-09-12T14:03:05Z"
  }
}

config.published

A configuration publish reached the resolvers and verified.

config.published

{
  "event": "config.published",
  "timestamp": "…",
  "data": { "publish_id": 4412, "trigger_action": "policy.update", "trigger_object": "…",
            "status": "success", "redis_keys_written": 38, "duration_ms": 214 }
}

config.failed

A publish did not complete or did not verify.

config.failed

{
  "event": "config.failed",
  "timestamp": "…",
  "data": { "publish_id": 4413, "trigger_action": "list.update", "trigger_object": "…",
            "status": "failed", "redis_keys_written": 0, "duration_ms": 31, "error": "…" }
}

list.updated

Entries were pushed into a list through the push API.

list.updated

{
  "event": "list.updated",
  "timestamp": "…",
  "data": { "list_uuid": "…", "entries_added": 3, "entries_skipped": 0, "entries_errors": 0, "source": "soar" }
}

feed.polled

A threat feed pull completed.

feed.polled

{
  "event": "feed.polled",
  "timestamp": "…",
  "data": { "feed_id": 12, "status": "success", "entries_created": 1284, "entries_updated": 40 }
}

device.registered

A roaming device registered against a virtual site.

device.registered

{
  "event": "device.registered",
  "timestamp": "…",
  "data": { "device_slug": "…", "hostname": "build-runner-07", "virtual_site": "…", "public_ip": "…", "platform": "linux" }
}

Evaluate Agent DNS with your own agent traffic

Forward events from a single policy to your SIEM and review them with your security team.

See It Live View Pricing