outflanknl / RedELK

Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.

BSD 3-Clause "New" or "Revised" License

2.35k stars 371 forks source link

Add support for domain lists (similar to IP lists) #270

Closed fastlorenzo closed 1 year ago

fastlorenzo commented 2 years ago

The same way as IP lists are managed, we should have domains stored in ES (and possibly via config files). Those domains will need to be enriched with classification. History of enrichment checks should be stored in the bluecheck index.

fastlorenzo commented 1 year ago

282 fixes this, ready to be merged