Skip to content

Instantly share code, notes, and snippets.

@jayswan jayswan/hn.bro
Last active Mar 21, 2017

Embed
What would you like to do?
track hostnames with Bro
type Idx: record {
hostname: string;
};
export {
redef enum Notice::Type += {
DNS_ENTRY::Tracked_Hostname
};
}
global hostnames: set[string];
event bro_init() {
Input::add_table([$source="/opt/bro/share/bro/site/hostnames.txt",$name="hostnames",$idx=Idx,$destination=hostnames]);
}
event dns_request(c:connection, msg:dns_msg, query:string, qtype:count, qclass:count) {
if (qtype == 6) {
if (query in hostnames) {
when ( local hn = lookup_hostname(query)) {
NOTICE([$note=DNS_ENTRY::Tracked_Hostname,
$conn=c,
$msg=fmt("saw tracked hostname %s at %s",query,hn)]);
}
}
}
}
event bro_done() {
Input::remove("hostnames");
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.