|
11 months ago | |
---|---|---|
bin | 11 months ago | |
etc | 11 months ago | |
LICENSE | 2 years ago | |
README.md | 1 year ago | |
install_server.sh | 11 months ago | |
launch_server.sh | 1 year ago | |
requirements | 2 years ago |
analyzer-d4-passivedns is an analyzer for a D4 network sensor. The analyser can process data produced by D4 sensors (in passivedns CSV format (more to come)) and ingest these into a Passive DNS server which can be queried later to search for the Passive DNS records.
./install_server.sh
All the Python 3 code will be installed in a virtualenv (PDNSENV).
Don’t forget to set the DB directory in the redis.conf configuration. By default, the redis for Passive DNS is running on TCP port 6400
./redis/src/redis-server ./etc/redis.conf
. ./PDNSENV/bin/activate
cd ./bin/
python3 ./pdns-cof-server.py
cd ./etc
cp analyzer.conf.sample analyzer.conf
Edit the analyzer.conf to match the UUID of the analyzer queue from your D4 server.
[global]
my-uuid = 6072e072-bfaa-4395-9bb1-cdb3b470d715
d4-server = 127.0.0.1:6380
# INFO|DEBUG
logging-level = INFO
then you can start the analyzer which will fetch the data from the analyzer, parse it and populate the Passive DNS database.
. ./PDNSENV/bin/activate/
cd ./bin/
python3 pdns-ingestion.py
The software is free software/open source released under the GNU Affero General Public License version 3.