Open Information Security Foundation

12/02/2025

FM 09:57 PM Suricata Feature #6802: Support Domain rollup using existing dataset library

Victor Julien wrote in #note-5:
> Hi @apex is there still interest in this?
We have implemented it and got it working.
It is useful in a very niche use case in IPS mode where new nefarious domains has to be added and activated instantly... Francois Methot

04/25/2024

FM 03:25 PM Suricata Feature #6802: Support Domain rollup using existing dataset library

Eric Leblond wrote in #note-3:
> Hello François, what is your final goal ? Is the domain keyword like implemented in https://github.com/OISF/suricata/pull/8155 enough for your need ? We still need a discussion on the crate to use but the... Francois Methot

04/18/2024

FM 06:12 PM Suricata Feature #6802: Support Domain rollup using existing dataset library

Support domain rollup matching against existing dataset funcitonnality (endswith like behavior)
Option 1 - Domain rollup using specialized Matcher
The matcher would navigate the input buffer string, backward, and for each . (dot) woul... Francois Methot

02/22/2024

FM 08:18 PM Suricata Feature #6803 (Closed): Add Support for Dataset Metadata

A dataset entry would be added with an associated business id Francois Methot

FM 08:10 PM Suricata Feature #6802 (Feedback): Support Domain rollup using existing dataset library

Support domain rollup using specialized Matcher leveraging dataset code.
The matcher would navigate the input buffer string, backward, and for each . (dot) would query the dataset for the presence of the subdomain.
ex:
api.google.co... Francois Methot