search

CybOXProject / schemas

CybOX Schemas and Schema Development
42 stars 17 forks source link

Split up DNS Query Object into Query/Response Objects #332

Open ikiril01 opened 9 years ago

ikiril01 commented 9 years ago

Our current DNS Query Object encompasses both DNS Queries and the subsequent responses for these queries. For granularity, flexibility, and consistency we should probably split this up into separate DNS Query and DNS Response Objects.

gtback commented 9 years ago

The same is probably true for HTTP Request and HTTP response, and perhaps others.

ikiril01 commented 9 years ago

Related to #182 (now closed): "We should add the ability to capture the DNS Query Responses, which will likely entail the creation of a new DNS Response Object, as well as modification of the existing DNS Query Object for the capture of the response as part of the query.

For the DNS Response, we should consider capturing the following:

Transaction ID Response Code Discrete elements for DNS response flags (e.g., AA = Authoritative Answer; RD = Recursion Desired, RA = Recursion Available, TC = Truncation)"