Project

General

Profile

Actions

Feature #6621

open

Task #6597: rules keyword/output parity: improve

Feature #5642: DNS: parity between log fields and detection

dns: add keyword for dns rcode: dns.rcode

Added by Jason Ish 4 months ago. Updated about 1 month ago.

Status:
Resolved
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:

Description

DNS records log the rcode, but it is not available for detection. For example:

{
    "@timestamp": "2023-12-11T17:31:16.621Z",
    "community_id": "1:wQg9tR3nlxBAH4VrGg6YGsAa6AA=",
    "dest_ip": "10.16.1.1",
    "dest_port": 53,
    "dns": {
        "answers": [
            {
                "rdata": "l-0007.l-msedge.net",
                "rrname": "config-edge-skype.l-0007.l-msedge.net",
                "rrtype": "CNAME",
                "ttl": 152
            }
        ],
        "flags": "8180",
        "id": 49242,
        "opcode": 0,
        "qr": true,
        "ra": true,
        "rcode": "NOERROR",
        "rd": true,
        "rrname": "config.edge.skype.com",
        "rrtype": "HTTPS",
        "type": "answer",
        "version": 2
    },
    "event_type": "dns",
}

The dns.opcode keyword should be a good starter for the rcode as both are present in the header as integers. Even though we long to string representation of the rcode, the keyword should probably first start by accepting the integer value, then maybe we could add string representations after.


Related issues 1 (1 open0 closed)

Blocked by Suricata - Bug #6281: dns: structure of query differs between "alert" and "dns" event typesIn ProgressJason IshActions
Actions #1

Updated by Hadiqa Alamdar Bukhari 4 months ago

  • Target version changed from TBD to 8.0.0-beta1
Actions #2

Updated by Hadiqa Alamdar Bukhari 4 months ago

Can this keyword be negated?

Actions #3

Updated by Juliana Fajardini Reichow 4 months ago

Hadiqa Alamdar Bukhari wrote in #note-2:

Can this keyword be negated?

Answered here: https://github.com/OISF/suricata/pull/10087#discussion_r1435191583

Actions #5

Updated by Hadiqa Alamdar Bukhari 4 months ago

  • Status changed from New to In Progress
Actions #6

Updated by Jason Taylor 4 months ago

Thanks for working on this Hadiqa! We (ET team) were wondering if it would be possible to add comparison functionality (e.g. <, >, <>) similar to urilen?

One thing that came up also was if it would be possible to allow an array of values [0, 11, 23], for example?

Actions #7

Updated by Philippe Antoine 4 months ago

  • Blocked by Bug #6281: dns: structure of query differs between "alert" and "dns" event types added
Actions #8

Updated by Philippe Antoine 4 months ago

@Jason Taylor array of values are not supported for integers yet... :-/

Actions #9

Updated by Jason Taylor 3 months ago

Philippe Antoine wrote in #note-8:

@Jason Taylor array of values are not supported for integers yet... :-/

Ah okay. Would the comparison options be possible?

Actions #10

Updated by Philippe Antoine 3 months ago

  • Status changed from In Progress to In Review
Actions #11

Updated by Juliana Fajardini Reichow 3 months ago

Jason Taylor wrote in #note-9:

Philippe Antoine wrote in #note-8:

@Jason Taylor array of values are not supported for integers yet... :-/

Ah okay. Would the comparison options be possible?

The comparison options, yes :)

Actions #12

Updated by Juliana Fajardini Reichow about 1 month ago

  • Status changed from In Review to Resolved
Actions

Also available in: Atom PDF