Secure Service Edge · Topic 5 of 5
Interpreting Cisco Secure Access Investigate Scores and Indicators
Learn to read Investigate results in Cisco Secure Access: status, risk scores, categories, DNS patterns, WHOIS and relationships, and how to act on them.
- 5 min
- Investigate combines Talos intelligence with DNS data for domains, IPs, URLs and files.
- A higher risk score means higher risk. A not yet classified verdict is not the same as safe.
- Security categories name the type of threat, such as phishing or command and control.
What it is
Investigate is a threat intelligence tool that tells you what Cisco knows about a domain, an IP address or a file.
When an alert names a domain, you need to decide if it is dangerous. Investigate gives you data from Cisco Talos and from the DNS traffic that Cisco sees. You read the scores and indicators, and then decide to block, allow or watch.
How it works
No single indicator proves anything, so read the scores together and in context.
What you can look up
You can search for a domain name, an IP address, a URL or a file hash. The result pulls together reputation, category, history and relationships for that item.
Status and risk score
The first things to read are the overall verdict and the score.
| Indicator | How to read it |
|---|---|
| Status or verdict | Malicious, benign or not yet classified |
| Risk score | A number, where a higher value means higher risk |
| Security categories | Labels such as malware, phishing, command and control or newly seen |
A malicious verdict backed by a security category is strong evidence. A not yet classified result means that the data is limited, and not that the domain is safe. The risk score is a summary of many signals, so look at what drives it before you act.
DNS and traffic indicators
Investigate shows how the domain is used on the internet, and that history tells you a lot.
- Query volume pattern: a legitimate site has steady traffic. A sudden spike can mean a new campaign.
- Popularity or ranking: a domain that is high in global popularity lists is rarely malicious, but an unknown low volume domain deserves more care.
- Age and first seen: a very new domain is more suspicious, since attackers register fresh domains.
- Resolving addresses and TTL: very short TTLs and many changing addresses can point to fast flux hosting.
Domain generation and name features
Some malware creates random looking domain names to find its command servers. Investigate can show features of the name, such as how random it looks. A long string with no meaning, in a domain that has just appeared, is a typical sign of a generated name.
Registration data
WHOIS records show the registrant, the registrar and the registration dates. Privacy services hide the owner for many good sites, so a hidden owner is not proof of bad intent. Several unrelated bad domains registered by the same contact are a strong link.
Network and relationship indicators
| Indicator | What it tells you |
|---|---|
| Hosting IP and ASN | Whether the domain sits on infrastructure that is known for abuse |
| Related domains | Other domains hosted with it, or with similar names |
| Co-occurrences | Domains that users often query at nearly the same time |
| Associated files | Samples of malware that talk to the domain |
Relationships let you pivot. If one domain is confirmed as bad, its neighbours on the same address or with the same registrant are worth checking too, and you can add them to a block list.
Turning findings into action
Compare what you found with your own data. Ask which users queried the domain, and whether the device then downloaded a file or opened a long lived connection.
If the evidence is strong, block the domain in policy and investigate the affected hosts. If it is weak, monitor, and revisit when more data arrives.
Example reasoning
A user device queries a domain registered two days ago. It has no popularity ranking and a random looking name, and Investigate lists it in a command and control category. The pieces agree, so you block it and examine the host.
A second domain is new but belongs to a recognised software vendor, with a good registrant history and a clean category. You allow it, and note the finding.
What to remember for the exam
Six facts cover most questions on this topic.
- Investigate combines Talos intelligence with DNS data for domains, IPs, URLs and files.
- A higher risk score means higher risk. A not yet classified verdict is not the same as safe.
- Security categories name the type of threat, such as phishing or command and control.
- New registration, DGA like names, short TTLs and spikes in queries are suspicious signals.
- Related domains, co-occurrences, ASN and WHOIS data help you pivot to more bad infrastructure.
- Read indicators together, and combine them with your own logs.
When indicators conflict, trust a confirmed malicious category and a strong pattern over a single odd feature.
Common mistakes
These four mistakes appear often.
Treating an unknown domain as safe. Lack of data is not evidence of safety.
Acting on one indicator. A new domain alone is not proof of an attack.
Trusting WHOIS privacy as a clue. Many legitimate sites hide their owners.
Ignoring your own telemetry. Investigate tells you about the domain, and your logs tell you who contacted it.
Blocking a shared hosting address can break many good sites. Check the related domains before you block an IP address.
Check yourself
Work through these three questions.
Does an unclassified verdict mean that a domain is safe?
No, it means that there is not enough data to classify it, so look at other indicators.
Which indicators suggest a newly created malicious domain?
A very recent registration, a random looking name, a sudden spike in queries and a security category such as command and control.
Why look at related domains and co-occurrences?
They let you pivot from one confirmed bad domain to other infrastructure that may belong to the same attacker.
Topic 5 of 5 in Secure Service Edge
Test yourself on Secure Service Edge
The full Cisco CCNP 350-701 SCOR question bank has 822 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.