Excessive NXDOMAIN DNS Queries (ASIM DNS Schema)
'This creates an incident in the event a client generates excessive amounts of DNS queries for non-existent domains. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema'
Microsoft Sentinel (KQL)
