{
  "name": "DNS NXDOMAIN surge",
  "description": "A jump in non-existent domain lookups: a typo-squat campaign, a misconfigured client, or malware working through a generated domain list",
  "query": "service=bind dns_rcode=NXDOMAIN earliest=-10m | stats count",
  "query_language": "spl",
  "condition_type": "threshold",
  "eval_interval_seconds": 60,
  "for_minutes": 3,
  "notification_target_id": "__TARGET_SECURITY__",
  "enabled": true,
  "comparator": "gt",
  "threshold_value": 18
}