About xhoms

Hi @david.sherrill ,   yes. I'm afraid you need a new node (miner) per FQDN (details in the Google DNS API specification at https://developers.google.com/speed/public-dns/docs/dns-over-https) If you're planning to configure 10's or more of them then you might want to take a look to the FQDN-Service project (AWS Serverless Component you can deploy at almost no montly cost and that can resolve 100's of FQDN's at once)   Xavi ... View more

Hi @MichaelPDean,   this is a tricky one.   the right expression is already in your list (us-east-1.all_ips[].{indicator:@})  but it must be double escaped .   First, us-east-1 is not a valid python espression so you must quote it to become "us-east-1" . But you can't provide extractor: "us-east-1".all_ips[].{indicator:@} to the prototype because the YAML loader will fail parsing it due to the first double quote describing the value to be a string scalar and the dot character after the second double quote being considered as an invalid sequence.   So you must escape again for the YAML loader to consider the whole line a string scalar. The right value is then:   extractor: '"us-east-1".all_ips[].{indicator:@}'     ... View more

Hi @Hugh.Kelley,   can't comment on dns.google.com or dns-api.org but would like to provide some comments on https://github.com/PaloAltoNetworks/fqdn-service It is a "serverless implementation" (no VM needed). It is likely to cost you 0$ a month unless you share it with a large community of users It can resolve many FQDN's at once which means that a single miner is needed It can store a history of responses Take into account, though, that if you're using PANOS then you better create custom L7 apps (SSL Decrypt + matching the HTTP Host Header or SSL Response Certificate in case you're not decryting) instead of matching based on FQDN. FQDN matching is performed at "sample intervals" (i.e. once an hour) and these FQDN entries behind AWS rotate tipically at 1 minute intervals. That means that you will, probably, fail to match many sessions between sample intervals no matter which DNS service you end up using ... View more

Hi @carysoc,   the MineMeld standard library already includes a miner for that (azure.cloudIPs) ... View more