DNSNode

A DNS Node is the Active Directory object (dnsNode) that backs a single DNS record inside an AD-integrated DNS zone. Every hostname, service record, and IP mapping stored in the directory is one dnsNode beneath its dnsZone. Forestall enumerates these records, including planted or spoofed ones like wpad or wildcard entries, alongside the rest of the directory.

DNS Node Fields

Field	Type	Possible Operators	Description
FSName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	The display name of the DNS node object.
Name	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	The record name (the hostname or label within the zone).
DistinguishedName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	The full LDAP distinguished name of the dnsNode object.
risk	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Risk score calculated by Forestall.
AceAuditState	MULTI_LIST	IN	SACL audit coverage of the object's permissions (ACEs): Full when every ACE is covered by a success audit rule, Partial when some are, None when none are. Set only when the scan runs the permission (over-privilege) analysis. Values: None, Partial, Full.
Guid	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Unique identifier of the object in Forestall, a combination of the selected scan's GUID and the object's own identifier.
WhenCreated	DATE	SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY	Date and time the object was created.
WhenChanged	DATE	SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY	Date and time the object was last changed.
ExposurePoint	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Exposure point score calculated by Forestall.
Tier	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Tier level Forestall assigned to the object: 0 (Tier 0), 1 (Tier 1) or 2 (Tier 2). Lower is more privileged.