Explanation:

When you deploy the ASIM unifying parser for DNS , you should query the normalized schema via the function imDns() (ASIM convention: im < Domain > ). To maximize performance , pass filtering arguments directly to the parser so the function prunes data early at source, ra ther than piping a large dataset into subsequent where filters. ASIM DNS supports parameters such as starttime , endtime , and responsecodename (for example, NXDOMAIN ). Therefore, using imDns(starttime=ago(1d), responsecodename= ' NXDOMAIN
' ) limits ingestion t o the last 24 hours and only events whose ResponseCodeName equals NXDOMAIN .
Once normalized rows are returned, use summarize with bin() to aggregate efficiently. The ASIM DNS schema exposes the client address as SrcIpAddr ; grouping by this field and bin(TimeGenerated, 15m) produces per-source-IP counts in 15-minute buckets. The final query:
imDns(starttime=ago(1d), responsecodename= ' NXDOMAIN ' )
| summarize count() by SrcIpAddr, bin(TimeGenerated, 15m)
meets all requirements: it lists all DNS events with NXDOMAIN in the last 24 hours and aggregates them by source IP in 15-minute intervals , using ASIM's parameterized parser to achieve optimal performance.