Merge pull request #192 from splunk/CRL-1607-Fix-Weird-Italics

CRL-1608 Update dyn_dns_queries.json

detections/dyn_dns_queries.json

@@ -44,12 +44,12 @@
             }
         }
     },
-    "eli5": "The search is querying an accelerated `Network_Resolution` data model to count and list the values of resolved domains for each DNS query and checks that against the list of Dynamic DNS providers (lookup - `dynamic_dns_providers`) by each host (DNS.src)",
+    "eli5": "The search leverages an accelerated <code>Network_Resolution</code> data model to count and list the values of resolved domains for each DNS query. It checks the results against the list of Dynamic DNS providers in the lookup <code>dynamic_dns_providers</code> by each host (DNS.src).",
     "entities": [
         "dest",
         "query"
     ],
-    "how_to_implement": "First, you'll need to ingest data from your DNS operations. This can be done by ingesting logs from your server or data collected passively by Splunk Stream or similar solutions. Specifically, data that contains the domain that is being queried and the IP of the host originating the request must be populating the Network_Resolution data model. This search also leverages a lookup file, <code>dynamic_dns_providers_default.csv</code>, which contains a non-exhaustive list of Dynamic DNS providers. Please consider updating the local lookup periodically by adding new domains to the list of <code>dynamic_dns_providers_local.csv</code>.<br></br>This search produces fields (`query`,`answer`,`isDynDNS`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):<br></br><ul><li><b>Label:</b> DNS Query, <b>Field:</b> query</li><li><b>Label:</b> DNS Answer, <b>Field:</b> answer</li><li><b>Label:</b> IsDynamicDNS, <b>Field:</b> isDynDNS</li></ul><br></br>Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`",
+    "how_to_implement": "First, you'll need to ingest data from your DNS operations. This can be done by ingesting logs from your server or data, collected passively by Splunk Stream or a similar solution. Specifically, data that contains the domain that is being queried and the IP of the host originating the request must be populating the <code>Network_Resolution</code> data model. This search also leverages a lookup file, <code>dynamic_dns_providers_default.csv</code>, which contains a non-exhaustive list of Dynamic DNS providers. Please consider updating the local lookup periodically by adding new domains to the list of <code>dynamic_dns_providers_local.csv</code>.<br></br>This search produces fields (query, answer, isDynDNS) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable event. To see the additional metadata, add the following fields, if not already present, to Incident Review. Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):<br></br><ul><li><b>Label:</b> DNS Query, <b>Field:</b> query</li><li><b>Label:</b> DNS Answer, <b>Field:</b> answer</li><li><b>Label:</b> IsDynamicDNS, <b>Field:</b> isDynDNS</li></ul><br></br>Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`",
     "id": "c77162d3-f93c-45cc-80c8-22f6v5464g9f",
     "investigations": [
         {
@@ -103,4 +103,4 @@
     "spec_version": 2,
     "type": "splunk",
     "version": "1.0"
-}
+}