Honey pot recommendation for DNS sink holing

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Honey pot recommendation for DNS sink holing

L2 Linker

Dear all,

 

we are seeing many DNS alerts for spyware, but we don't have any DNS logs.

Also, internal hosts can't resolve external FQDNs, so probably most of the requests are coming from the proxy.

So we are thinking about setting up DNS sink holing with a honey pot.

Any recommendations what to use as a honey pot so that we can get the most information possible from the client connecting to it?

 

Thanks and Regards,

   Andreas

 

 

2 REPLIES 2

L2 Linker

Not a honeypot but Pi-Hole is what I use for both DNS sinkhole and primary DNS server in some cases.  I run it in VMware on CentOS8 or on a Raspberry Pi.

Cyber Elite
Cyber Elite

Hello,

DNS logs are a big deal. Have you looked into the following article to ensure sinkhole setup correctly and logging correctly:

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGECA0

 

Also I recommend using a secure DNS resolver for anything external.

Here is a link to a video I made for a conference about DNS:

https://youtu.be/ROIAYSEbTuo

Regards,

  • 1898 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!