Protective DNS Alert Set Training Video

Why It Matters

Automated DNS and administrative alerts enable rapid threat remediation and policy enforcement, strengthening an organization’s overall security posture.

Key Takeaways

• Configure DNS and system alerts to detect security events promptly
• Choose delivery cadence to balance alert frequency and email overload
• Enable CISA global policy alerts for urgent, action‑required notifications
• System event alerts track admin changes like user creation and policy updates
• Alert emails include detailed policy context, match counts, and timestamps

Summary

The video walks through configuring alert sets within the Protective DNS Resolver management console, detailing both DNS event alerts and system event alerts for organizations.

DNS event alerts trigger when queries match CISA‑global or agency‑specific filtering policies, allowing allow, block, or override actions. Users can select specific policies, source sets, thresholds, and a delivery cadence—hourly, daily, or weekly—to manage alert volume. System event alerts monitor administrative actions such as user onboarding, privilege changes, policy edits, source modifications, and system issues.

A step‑by‑step example creates an alert set called “Instructional Video Test,” enables CISA global policy alerts, and sets the email header to “Urgent: action required.” The tutorial shows selecting distribution lists, choosing on‑match versus threshold logic, and configuring the cadence. Resulting emails contain policy name, description, match counts, timestamps, and other contextual details.

Properly tuned alerts provide near‑real‑time visibility into DNS threats and admin changes, accelerating response and reducing compromise risk while preventing alert fatigue through cadence controls.

Original Description

CISA’s Protective Domain Name System (#ProtectiveDNS) service delivers greater protection, increased visibility, and enhanced capabilities for federal civilian executive branch agencies and select critical infrastructure partners in our mission to reduce cyber risk.

Watch our newest Protective DNS alert set training video.

To learn more about Protective DNS, visit CISA.gov or contact [e-mail].