Whitelisting Load-Balanced Sites - Fetch DNS records as JSON

Reply
L2 Linker

Whitelisting Load-Balanced Sites - Fetch DNS records as JSON

For sites (to be whitelisted) that are behind ever-changing IP ranges (e.g. Amazon load balancer), has anybody used a services like these?   

 

https://dns.google.com/resolve?name=www.netflix.com 

https://dns-api.org/A/www.netflix.com

 

Is there an existing miner that does DNS lookups?

 

I saw this recommend in another thread but I'm hoping to avoid another VM:

 

https://github.com/PaloAltoNetworks/fqdn-service

 

This is the prototype I'm using

 

prototypes:
    dnsLookup:www_netflix_com:
        class: minemeld.ft.json.SimpleJSON
        config:
            age_out:
                default: null
                interval: 3600
                sudden_death: true
            attributes:
                confidence: 100
                share_level: green
                type: IPv4
            extractor: Answer[?type == `1`]
            fields:
            - name
            indicator: data
            prefix: dns
            source_name: dns.netflix
            url: https://dns.google.com/resolve?name=www.netflix.com
        development_status: STABLE
        indicator_types:
        - IPv4
        node_type: miner
        tags:
        - ConfidenceHigh
        - ShareLevelGreen
Highlighted
L5 Sessionator

Re: Whitelisting Load-Balanced Sites - Fetch DNS records as JSON

Hi @Hugh.Kelley,

 

can't comment on dns.google.com or dns-api.org but would like to provide some comments on https://github.com/PaloAltoNetworks/fqdn-service

  • It is a "serverless implementation" (no VM needed). It is likely to cost you 0$ a month unless you share it with a large community of users
  • It can resolve many FQDN's at once which means that a single miner is needed
  • It can store a history of responses

Take into account, though, that if you're using PANOS then you better create custom L7 apps (SSL Decrypt + matching the HTTP Host Header or SSL Response Certificate in case you're not decryting) instead of matching based on FQDN. FQDN matching is performed at "sample intervals" (i.e. once an hour) and these FQDN entries behind AWS rotate tipically at 1 minute intervals. That means that you will, probably, fail to match many sessions between sample intervals no matter which DNS service you end up using

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!