alphasoc / nfr

A lightweight tool to score network traffic and flag anomalies
https://alphasoc.com
Other
122 stars 19 forks source link

asoc.Entry should be a struct. #12

Closed ioj closed 7 years ago

ioj commented 7 years ago

Please refactor asoc.Entry into a struct instead of []string. I'd suggest using net.IP and time.Time for endpoint and timestamp information respectively.

You can then implement a function which unpacks layers.DNSQuestion into it (along with timestamp and endpoint info) and methods for JSON marshalling, whitelist matching and anything else required.

phob0s-pl commented 7 years ago

done