DNS DGA and tunnel detection

You can configure DNS Domain Generation Algorithm (DGA) detection and DNS tunnel detection. This feature enables you to block the malicious domains and DNS-tunneled requests or responses generated by infected hosts and command-and-control (C&C) servers. DGA periodically generates a large number of domain names that are used as rendezvous points (RPs) with their C&C servers. DNS tunneling is a cyberattack method that encodes the data of other programs or protocols in DNS queries and responses. 

Use the set security-metadata-streaming policy policy-name detections dga and set security metadata-streaming policy policy-name detections tunneling commands at the [edit services] hierarchy to configure DNS DGA and tunneling detections.