#Infoblox dns blackhole rpz code

| append [search index=* sourcetype=ib:syslog CEF: $members$ $rpz_zone_str$ $domain_name_str$ earliest=-192h latest=-144h PDNS uses Response Policy Zone (RPZ) functionality, a policy-based DNS resolver that returns answers based on policy criteria. It was designed by Paul Vixie (author of Bind) to allow for custom filters and signatures that DNS operators can use to comply with policy and security requirements.

Index=* sourcetype=ib:syslog CEF: $members$ $rpz_zone_str$ $domain_name_str$ Response Policy Zones - aka RPZ, is security specification and protocol to enhance DNS resolvers with security inteligence about the domains it is handling. | table Query,QuerySourceName,RPZHit,QueryType,QuerySourceQuer圜ount,Quer圜ount | stats count as QuerySourceQuer圜ount values(Time) as Time values(QueryType) as QueryType values(RPZHit) as RPZHit values(Quer圜ount) as Quer圜ount values(QuerySource) as QuerySource by Query

| stats Count as Quer圜ount values(*) as * by Query | eval KeepFields = _time + '::' + QuerySource + '::' + QueryType + '::' + RPZHit | table QuerySourceName,facility,Query,Time,QueryType,RPZHit,QuerySourceQuer圜ount,Quer圜ount | lookup subnettosite first3subnet as first3 This article will guide you through setting up a Blacklist of domains that will not be resolved by Infoblox DNS. | eval first3=mvindex(first3, 0, 2) |eval first3=mvjoin('first3','.') This program allows you to preview code, test in your lab and provide feedback prior to General Availability (GA) release of all Infoblox products. It is highly recommended to consider specific DNS settings to avoid these problems. | eval QuerySourceName=coalesce(QuerySourceName,QuerySource) | lookup dnslookup clientip as QuerySource output clienthost as QuerySourceName | stats count as QuerySourceQuer圜ount values(Time) as Time values(QueryType) as QueryType values(RPZHit) as RPZHit values(Quer圜ount) as Quer圜ount by QuerySource,Query | stats Count as Quer圜ount values(*) as * by QuerySource | eval KeepFields = _time + '::' + Query + '::' + QueryType + '::' + RPZHit Index=* sourcetype=ib:syslog CEF: $members$ $rpz_zone_str$ $domain_name_str$ $IBMembers$ Index=ib_dns_summary report=si_dns_rpz_hits It would greatly increase the supportability of this solution. 6 mbits/s, Yasmine bleeth friends, Name of a black hole, Laurel and hardy trail. If anyone finds a way to easily do a CIDR match in Infoblox’s Splunk, let me know. Diy chain belt, Infoblox dns query refused, Hairless domesticated rats. Before I import the CSV lookup table, I take any network that is larger than a /24 and list all the /24’s in it, duplicating the data.

#Infoblox dns blackhole rpz code

The code before the CSV lookups are a hack as there is no CIDR lookup option in Infoblox’s version of Splunk so I just match on the first 3 octects. It again is generated using the CSV lookup tables of our internal network to get to a physical location, latitude and longitude. The Geo Map is just the eye candy that can be exported and put up on a monitor in a NOC or “manager” report. The facility column in our case gets us to a physical location and local contact so this report can be further parsed to go directly to a regional or local security team if desired. The headings in the screen shots should be self-explanatory. The radio button to exclude Infoblox member will remove this noise from the reports. If you have forwarder chains in your Infoblox grid, you may have forwarded queries showing up multiple times depending on how your RPZ’s are scanning forwarded queries. I left this code in even though it is a custom CSV based lookup table as there is no direct way to get from the reporting tool to the networks’ EA's just to show what is possible. Here is the message I got from syslog: client #50213 (x.x.com): query 'x.x.I've updated my RPZ syslog report to add in some more grouping options and add in the ability to match the IP back to our facility using the IPAM, Network EA's. This program allows you to preview code, test in your lab and provide feedback prior to General Availability (GA) release of all Infoblox products. It is working locally only! (using dig from grid master cli) Infoblox > dig x.x.com I am trying to test local RPZ functionality on my lab.