a good friend of mine also has a startup that is really good at both signature-based and behavioral dns analytics if this is something you're monitoring at the network level as well: https://alphasoc.com