Subscribe to the Taegis™ XDR Documentation RSS Feed at .

Learn more about RSS readers or RSS browser extensions.

Domain Generation Algorithms


The Domain Generation Algorithm (DGA) Detector is a machine learning classifier that has been trained with both known information on real domain names and on malicious domain names. The DGA Detector then applies that learning to the client’s streaming DNS data in order to find domains that potentially could be indicators of malicious activity.

Domain Generation Algorithm

Domain Generation Algorithm Alert

The DGA Detector classifies domains into two categories: good or bad. When it finds a bad domain, it sends it as an alert to the Secureworks® Taegis™ XDR Dashboard and the Secureworks® Taegis™ XDR Alert Database. Note that when an alert is added, it doesn’t indicate that the domain is intrinsically bad—but it can help you identify or confirm malicious activity in combination with other alerts provided by the other Detectors.


Taegis™ and Red Cloak™ Endpoint Agent DNS feed and any other source of DNS events that are ingested and normalized into the Secureworks® Taegis™ XDR data lake in real time with a typical latency of no more than an hour.


DGA alerts pushed to the Secureworks® Taegis™ XDR Alert Database and Secureworks® Taegis™ XDR Dashboard.


MITRE Enterprise ATT&CK - Command And Control - Domain Generation Algorithms. For more information, see MITRE Technique T1568.002.

Configuration Options



Event data related to alerts produced by the Domain Generation Algorithm (DGA) detector may be delayed up to ten minutes after the alert appears in the Secureworks® Taegis™ XDR application.

Detector Requirements


On this page: