search

PaloAltoNetworks / SafeNetworking

Read only mirror. To contribute or submit issues, please go to the website link --->
https://gitlab.com/panw-gse/as/SafeNetworking/
Apache License 2.0
12 stars 10 forks source link

Domain resolution in event document #9

Closed punisherVX closed 6 years ago

punisherVX commented 6 years ago

Expected behavior and actual behavior.

Currently, the domain event does not have the domain actually resolved to the IP in the event doc. Customer has requested that this be part of the event processing.

Specifications like the version of the project, operating system, or hardware.

SFN3.0+

punisherVX commented 6 years ago

Best way to approach this is to have it done by logstash at ingest time. There is a domain resolution plugin that could work for this and needs to be tested.

punisherVX commented 6 years ago

This is part of the logstash enrichment and is done using the DNS filter plugin for logstash. It is commented out in the default file with instructions on un-commenting and a warning about the fact that if the logging server is behind a NGFW that will trigger on the DNS query, the user will cause a recursive loop that will not be fun to recover from.