topic Re: Domain whitelist appears to be case sensitive, is it? in General Topics

Domain whitelist appears to be case sensitive, is it?

MichaelPDean — Wed, 12 Jul 2017 20:38:43 GMT

I created a domain whitelist called wlDomains, a node based on stdlib.listDomainGeneric and added the whitelist to my domain aggregator. I then added the indicator "aol.com" (lowercase, without the quotes).

When I checked the feed for the output node though, it still listed "AOL.COM". I had to add an all uppercase entry to wlDomains in order for AOL.COM to be removed.

Is this expected?

Thanks,

Mike

Re: Domain whitelist appears to be case sensitive, is it?

lmori — Thu, 13 Jul 2017 06:56:33 GMT

Hi @MichaelPDean,

you are right, this should be improved. But the best place is improving the aggregator to support case insensitive matches. I have created and ER to track this: https://github.com/PaloAltoNetworks/minemeld-core/issues/229

luigi

Re: Domain whitelist appears to be case sensitive, is it?

deanm — Sun, 11 Mar 2018 16:14:52 GMT

Coming back to this, I see the option was closed back in Sep, 2017, but I find that the DNS white list is still case sensitive (I white listed aol.com, the domain feed has AOL.COM, still in the feed as a suspicious domain).

Is it going to remain this way?

Thank you.