brexhq / substation

Substation is a toolkit for routing, normalizing, and enriching security event and audit logs.
https://substation.readme.io
MIT License
330 stars 21 forks source link

fix: DNS errors #50

Closed jshlbrd closed 1 year ago

jshlbrd commented 1 year ago

Description

Motivation and Context

Querying DNS with unknown data is likely to result in resolution failures, so this adds a field to explicitly enable errors for certain calls in the processor. This mimics functionality in the Lambda processor and will make its way into other processors through a refactor in 2023.

This also adds a new pattern for querying Team Cymru's Malware Hash Registry.

How Has This Been Tested?

Unit tested via process/example_test.go (change the IP address to something that doesn't exist, such as 127.0.0.2). Tests for the MHR pattern are available internally.

Types of changes

Checklist: