dns_stats.xml

<group name="dnsstat,">
 <rule id="100010" level="5">
    <field name="integration">dnsstat</field>
    <description>DNS Stats</description>
    <options>no_full_log</options>
    <group>dnsstat_alert,</group>
  </rule>
<rule id="100011" level="5">
    <if_sid>100010</if_sid>
    <field name="dnsstat.alerts">LOW-FREQ-SCORES|SUSPECT-FREQ-SCORE</field>
    <description>DNS Stats - Low Frequency Score in Queried Domain</description>
    <mitre>
     <id>T1071</id>
    </mitre>
    <options>no_full_log</options>
    <group>dnsstat_alert,</group>
  </rule>

<rule id="100012" level="5">
    <if_sid>100010</if_sid>
    <field name="dnsstat.alerts">YOUR-FIRST-CONTACT</field>
    <description>DNS Stats - Domain Queried for the first time</description>
    <mitre>
     <id>T1071</id>
    </mitre>
    <options>no_full_log</options>
    <group>dnsstat_alert,</group>
  </rule>
<rule id="100013" level="5">
      <if_sid>100010</if_sid>
      <field name="dnsstat.category">NEW</field>
      <description>DNS Stats - DNS Query to Recently Created Domain</description>
      <mitre>
       <id>T1071</id>
      </mitre>
      <options>no_full_log</options>
      <group>dnsstat_alert,</group>
    </rule>
<rule id="100014" level="5">
    <if_sid>100010</if_sid>
    <field name="dnsstat.error">\.+</field>
    <description>DNS Stats - Error connecting to API</description>
    <options>no_full_log</options>
    <group>dnsstat_error,</group>
  </rule>
</group>