Finding Unknown DNS Servers

The out of the box groups are just there as a placeholder or to give you a sense of what you can set up for yourself.  You are very much encouraged to create you own groups.  You would have to define them as a range rather than CIDR address blocks.  To your specific question about DNS, I could see building up a group with all approved dns and then filter for any traffic on port 53 that isn't sourced or destined for that group. Solarwinds LEM has a built in rule for this so i've never tried to do the same thing within NTA but I am sure it can be done with some poking around.

The basic documentation on setting up IP Address groups is here

SolarWinds NTA settings

Yes thank you. I was able to find the IP group settings shortly after I sent this message. I do have LEM, but have yet to utilize it. Any help with it? That may be worth looking into. Thanks for the suggestion.

To take advantage of the LEM rule you need to populate a user defined list of the allowed DNS servers, and you have to be getting the logs from your firewalls.Once you have those in place you just enable the built in DNS rule (can't recall the exact name off the top of my head unfortunately) 

To take advantage of the LEM rule you need to populate a user defined list of the allowed DNS servers, and you have to be getting the logs from your firewalls.Once you have those in place you just enable the built in DNS rule (can't recall the exact name off the top of my head unfortunately)