D4
/
analyzer-d4-passivedns
mirror of https://github.com/D4-project/analyzer-d4-passivedns
2
0
Fork 0
Code Issues Releases Wiki Activity

chg: [pdns] filter option to exclude records added

pull/3/head
Alexandre Dulaunoy 2019-04-02 10:03:11 +02:00
parent 94042a198e
commit 853e1144b9
No known key found for this signature in database
GPG Key ID: 09E2CD4944E6CBCD
2 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
bin/pdns-ingestion.py
View File

@ -27,7 +27,7 @@ config = configparser.RawConfigParser()
config.read('../etc/analyzer.conf') config.read('../etc/analyzer.conf')
expirations = config.items('expiration') expirations = config.items('expiration')
excludesubstrings = config.get('exclude', 'substring').split(',')
myuuid = config.get('global', 'my-uuid') myuuid = config.get('global', 'my-uuid')
myqueue = "analyzer:8:{}".format(myuuid) myqueue = "analyzer:8:{}".format(myuuid)
mylogginglevel = config.get('global', 'logging-level') mylogginglevel = config.get('global', 'logging-level')
@ -89,7 +89,7 @@ def process_format_passivedns(line=None):
while (True): while (True):
expiration = None expiration = None
d4_record_line = r_d4.rpop(myqueue) d4_record_line = r_d4.rpop(myqueue)
if d4_record_line is None: if d4_record_line is None:
time.sleep (1) time.sleep (1)
continue continue
@ -103,6 +103,13 @@ while (True):
logger.debug('Parsing of passive DNS line is incomplete: {}'.format(l.strip())) logger.debug('Parsing of passive DNS line is incomplete: {}'.format(l.strip()))
continue continue
if rdns['q'] and rdns['type']: if rdns['q'] and rdns['type']:
excludeflag = False
for exclude in excludesubstrings:
if exclude in rdns['q']:
excludeflag = True
if excludeflag:
logger.debug('Excluded {}'.format(rdns['q']))
continue
for y in expirations: for y in expirations:
if y[0] == rdns['type']: if y[0] == rdns['type']:
expiration=y[1] expiration=y[1]

2
etc/analyzer.conf.sample
View File

@ -6,3 +6,5 @@ logging-level = INFO
[expiration] [expiration]
16 = 24000 16 = 24000
99 = 26000 99 = 26000
[exclude]
substring = spamhaus.org,asn.cymru.com