A high volume of DNS queries to unknown domains may indicate domain generation algorithm (DGA) activity associated with malware.
Checking for data exfiltration is the next logical step to determine if sensitive data is being leaked to these domains.
Reconfiguring DNS settings, browsing unknown domains, or blocking the domains are reactive steps that do not address the root cause.

XSS stands for cross-site scripting, which is a type of attack that injects malicious code into a web page that is then executed by the browser of a victim. The URL in the question contains a script tag that tries to execute a JavaScript code from an external source, which is a sign of XSS.

Pen testing tells you how an opponent could get into your environment. It emphasizes the potential damage of not hardening the environment by showing how different vulnerabilities might be exploited or identifying insecure IT practices.
Threat hunting tells you who is already in your environment and what they're up to. It deals with the actual state of the environment and shows what threats are targeting the company.
They're both methods used by defenders to bolster their security, but the former deals with possibly scenarios which may lead to a breach, while the latter works backwards- first looking for a breach, then working backwards to a vulnerability.

The self-healing system attempted to restart the services, but the disk space on the data drive was insufficient to do so. This indicates that the disk utilization alarms were higher than what the service restarts required, indicating that the system was unable to detect the issue and the services did not fully restart. This is the reason why the silent failure occurred.