Help Center/ Cloud Firewall/ Best Practices/ Using CFW to Audit Domain Name Access Behavior in Outbound Traffic
Updated on 2026-08-21 GMT+08:00
View PDF
Share

Using CFW to Audit Domain Name Access Behavior in Outbound Traffic

Capability and Benefits

Using CFW traffic logs, you can efficiently collect statistics on and audit the external domain names proactively accessed by internal resources. This helps network and security teams to:

  • Establish a service baseline: Review the external domain names proactively accessed by internal services to build a compliant access whitelist.
  • Detect suspicious behavior: Compare the domain names in outbound connections against the service baseline or threat intelligence to quickly detect compromised servers or suspicious connections (such as C&C domains and malicious download sources).

Technical Principles

When CFW analyzes outbound traffic, it extracts and logs domain name information using the following mechanisms:

  • For HTTP traffic, it parses the Host field in the HTTP request header.
  • For HTTPS traffic, it parses the Server Name Indication (SNI) extension field in the Client Hello packet sent by the client during the TLS handshake.

Scenario 1: Auditing the Access Records of a Domain Name

  • Requirements: An enterprise network administrator needs to audit the accesses from internal assets to a specific cloud platform or third-party partner domain.
  • Solution:
    1. Log in to the CFW console.
    2. Click in the upper left corner of the management console and select a region or project.
    3. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
    4. In the navigation pane, choose O&M Analysis > Log Query. Click the Traffic Logs tab.
    5. Select the time range from the drop-down list. Set the search criteria to Destination Host and select is equal to =. Enter the destination domain name and press Enter.

      The access records of the destination domain name are displayed, including the source IP address, start time, end time, and traffic volume.

      Figure 1 Domain name access records
  • Outcome: The system accurately finds all the related outbound session records, including their source IP addresses, access time, and traffic volume.

Scenario 2: Checking and Handling Abnormal Outbound Connections

  • Requirements: The network administrator finds that the outbound bandwidth or connection count increases sharply.
  • Solution:
    1. Dashboard check: On the CFW dashboard or traffic visualization page, the administrator can check the domain names with the most outbound access traffic in the last hour.
      1. Log in to the CFW console.
      2. Click in the upper left corner of the management console and select a region or project.
      3. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
      4. In the navigation pane, choose O&M Analysis > Traffic Center. On the displayed page, click the Outbound Traffic tab.

        By default, the dashboard displays the external traffic statistics in the last hour.

      5. In the Visualizations area in the lower part of the dashboard page, check Top Accessed Domain Names.
    2. Cause analysis: On the dashboard, click the access count of a domain name to check access details. If a specific internal service sent a large number of requests to a specific domain name (for example, more than 500 requests within one hour), this indicates an obvious anomaly.
      1. In the Top Accessed Domain Names area, click the access count of a domain name. The access details are displayed.
        Figure 2 Top Accessed Domain Names
      2. In the Top Accessed Domain Names area, check access details. If a specific internal service sent a large number of requests to a specific domain name (for example, more than 500 requests within one hour), this indicates an obvious anomaly.
        Figure 3 Details about top accessed domain names
    3. Collaborative remediation: The administrator immediately coordinates with the service team to verify system operational status and works alongside the security team to analyze the threat.
  • Outcome: Once the high-frequency outbound access is confirmed as malicious, the security team quickly responds to the incident. They deploy blocking rules via the CFW access control policy to immediately block access to the malicious external domain.

References