Sinkholed domain

If I have Cortex XDR + palo alto NGFW and an internal DNS server, and a user queries a malicious domain that gets sinkholed In XDR, should the alert show the DNS server as source and I have to pivot to find the endpoint, or should it be automatically tied to the actual endpoint that made the requ