Explanation:

In Microsoft Sentinel's Advanced Security Information Model (ASI M) , DNS queries are normalized through the Im_Dns parser, which unifies DNS telemetry from multiple sources (Infoblox, Windows DNS, Azure Firewall DNS proxy, etc.). Microsoft guidance states that when you need broad compatibility and want to "use built-in ASIM parsers whenever possible," you should call the generic Im_Dns() parser . To minimize overhead , ASIM provides a pack parameter that restricts the parser to a specific content pack (vendor/source) so it won't iterate through all available source parsers under the hood. For Infoblox NIOS, you pass the Infoblox pack via the pack parameter, which limits parsing to the Infoblox implementation and reduces query cost/latency while keeping the query portable across environments.
Putting it together, the recomme nded pattern is:
Im_Dns(pack= " InfobloxNIOS " )
| where DnsResponseCodeName == " NXDOMAIN "
| summarize count()
This approach satisfies all requirements:
* Uses built-in ASIM (Im_Dns).
* Minimizes query overhead (uses pack to limit parsing to Infoblox).
* Targets NXD OMAIN responses for counting DNS request failures from Infoblox1 .