"Rare client observed with high reverse DNS lookup count"

[DGOV-Bryce]

Third action is missing words:

"If the device(s) are domain controllers and , then the querying of domains could be usual activity and should be confirmed."

[Dinindu-Wick]

Updated the task description.