Graylog DNS Blacklisting

Hi there,

i’ve read this article from mr. koopmann with quite some interest:

sadly it stops where it gets exicting… and there is no follow up (even it was promised :D)

i have this message and i want to check it against a blacklist of domains.

08-Nov-2017 10:44:15.798 client (graph.facebook.c om): query: graph.facebook.c om IN A + (

this is my pipeline rule:

rule "DNS_Check_Blacklist"
set_field(“DNS_Domain_Malicious”, lookup_value(“dns_blacklist”, $message.DNS_Domain));

my lookup-table is like this:


my problem is this: if i do check my message against a lookup-table it works if the domain is exactly what is inside the lookup-table!

Table: graph.facebook.c om
Query: graph.facebook.c om -> works

Table: facebook.c om
Query: graph.facebook.c om -> doesnt work

while it is logic to me why it doesnt work, i cant imagine another way to get it work like i want it to.
I thought about another solution and came up with this: i could try to normalize the DNS_Domain field and create new fields like this:

DNS_Domain: facebook
DNS_TopLevel: com
DNS_SubDomain: graph

I could change the lookup-table to contain the new fields domain, toplevel, true and do a multi-value-lookup, but this doesnt feel like the right way to do it. And even if i am doing it like that the rule for extracting the new fields would be quite complex i guess (what should happen if the query looks like this: www.graph.facebook.c om or k). Does someone got the same problem and found a good solution for it?

sorry for formating the urls… i cant post more than two links…

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.