| DNS Query Flood | Outbound DNS queries per second (queries/s) | 500 in 30 s | 2,000 in 30 s | 5,000 in 30 s |
| DNS Flood | Outbound DNS queries per second (queries/s) | 500 in 30 s | 2,000 in 30 s | 5,000 in 30 s |
| Excessive DNS Queries | Outbound DNS queries per second (queries/s) | 100 in 1 min | 500 in 1 min | 2,000 in 1 min |
| DNS Enumeration | Distinct subdomains queried under one domain (names) | 200 in 10 min | 1,000 in 30 min | 5,000 in 1 h |
| DNS Tunnelling | Tunnelling indicators (0-100) (score) | 50 in 10 min | 70 in 30 min | 90 in 1 h |
| DNS Exfiltration | Tunnelling indicators (0-100) (score) | 50 in 10 min | 70 in 30 min | 90 in 1 h |
| DNS Beaconing | Regularity of repeated connections (0-100) (score) | 50 in 10 min | 70 in 30 min | 90 in 1 h |
| Randomised Subdomain Activity | Distinct subdomains queried under one domain (names) | 200 in 10 min | 1,000 in 30 min | 5,000 in 1 h |
| DGA Activity | Average entropy of queried names (bits) | 3.5 in 5 min | 4 in 10 min | 4.5 in 30 min |
| High-Entropy DNS Queries | Average entropy of queried names (bits) | 3.5 in 5 min | 4 in 10 min | 4.5 in 30 min |
| Suspicious DNS Resolution | Contacts with addresses on threat-intelligence lists (contacts) | 1 in 10 min | 10 in 1 h | 100 in 1 h |