Domain Name Parsing Advanced Setting

Beginning in Windows Agent 10.3, Domain Name Parsing can be enabled via the Advanced Setting, 'Domain Name Parsing'.

If the legacy Option is enabled, configuring an Advanced Setting will take precedence over the legacy Option.

Navigate to Advanced Settings.

Select the New Setting button at the top left.

In the Create Settings sidebar, select Domain Name Parsing from the Setting Type dropdown.

Next, select the desired 'Applies To'.

Then, select the required parameter.

Disable
- Driver registry key
  - Will be set to false
- Agent registry key
  - Will be present with Setting Mode 0 and paths []
- The driver will not parse domain names from network packets
All Processes
- Driver registry key will be set to true
- Agent registry key
  - Will be present with Setting Mode 1 and paths []
- The driver will parse domain names from network packets for all processes
Specified Paths
- Driver registry key
  - Will be set to true
- Agent registry key
  - Will be present with Setting Mode 2, and paths will be a list of paths, separated by commas
- The driver will parse domain names from network packets for a set list of processes which are maintained by the driver. "powershell.exe", "pwsh.exe", "msedge.exe", "chrome.exe", "chromium.exe", "firefox.exe", "opera.exe", "vivaldi.exe", "brave.exe", "iexplore.exe", "safari.exe", "maxthon.exe", "seamonkey.exe", "waterfox.exe", "palemoon.exe", "midori.exe", "falkon.exe", "browser.exe", "epic.exe", "avant.exe", "slimbrowser.exe", "duckduckgo.exe", "yandex.exe", "iridium.exe", "comodo_dragon.exe", "torch.exe", "msmpeng.exe" - defender.
- If Web Control product is enabled, web browser paths, although not stored in the registry key, will be included in the list of processes for which domain names are parsed, and be visible in the Unified Audit.

Select the 'Create' button.

To send this new setting to the Agents without waiting for a full check-in, press the 'Update Agents' button.

For assistance with enabling Advanced Settings, please see Advanced Settings | ThreatLocker Help Center.