A DNS Node is the Active Directory object (dnsNode) that backs a single DNS record inside an AD-integrated DNS zone. Every hostname, service record, and IP mapping stored in the directory is one dnsNode beneath its dnsZone. Forestall enumerates these records, including planted or spoofed ones like wpad or wildcard entries, alongside the rest of the directory.
DNS Node Fields
| Field | Type | Possible Operators | Description |
|---|---|---|---|
| FSName | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | The display name of the DNS node object. |
| Name | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | The record name (the hostname or label within the zone). |
| DistinguishedName | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | The full LDAP distinguished name of the dnsNode object. |
| risk | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL | Risk score calculated by Forestall. |
| AceAuditState | MULTI_LIST | IN | SACL audit coverage of the object’s permissions (ACEs): Full when every ACE is covered by a success audit rule, Partial when some are, None when none are. Set only when the scan runs the permission (over-privilege) analysis. Values: None, Partial, Full. |
| Guid | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Unique identifier of the object in Forestall, a combination of the selected scan’s GUID and the object’s own identifier. |
| WhenCreated | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY | Date and time the object was created. |
| WhenChanged | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY | Date and time the object was last changed. |
| ExposurePoint | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL | Exposure point score calculated by Forestall. |
| Tier | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL | Tier level Forestall assigned to the object: 0 (Tier 0), 1 (Tier 1) or 2 (Tier 2). Lower is more privileged. |