Create and Manage Metadata Streaming Profiles to Detect DNS Tunnels

In the Metadata Streaming Profiles section, click +.
The Create Metadata Streaming Profile page is displayed.
Enter a unique profile name within 63 alphanumeric characters. You can use special characters such as _ and -.
In the DNS section, enable the Tunnel detection toggle button.
Select the action that must be performed if a threat is detected:
- Deny—Drop the session.
- Sinkhole—Drop the session and sinkhole the request domain.
  
  Note:
  To sinkhole a request domain, you must configure the sinkhole settings for the device. To configure the settings from Juniper Security Director Cloud, click the device name on the Devices page and then click Junos Detailed Configurations > Services > Dns Filtering > Sinkhole.
- Permit—Permit the session.
Select how you want to log a request:
- Log detections—Log the request only if a threat is detected.
- Log everything—Log all requests received by the device.
Enable the Fallback options log toggle button to log the request if no threat is detected.
In the Inspection depth text box, enter the number of packets that must be inspected to detect a DNS tunnel.

Note:
The permitted range is 0-10. The default value is 4 packets. If you enter 0, Juniper Security Director Cloud inspects all the packets.
To store DNS requests in cache, enable the Cache TTL toggle button and enter the duration for which requests from beningn and command-and-control (C2) domains must be stored.
Click OK.
The metadata streaming profile is created and displayed on the Metadata Streaming Policy page.

Manage Metadata Streaming Profiles

Edit—Select the profile, and then click .
Clone—Select the profile, and then click More > Clone.

Note:
By default, the profile name is suffixed with _copy_1.
Delete—Select the profile, and then click .