You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
Axtux c09ef66bc0 create db directory and correct path 3 years ago
bin only remove extrema dots 3 years ago
etc create db directory and correct path 3 years ago
LICENSE chg: [doc] Basic README added 4 years ago
README.md chg: [doc] minimal install guide added 4 years ago
install_server.sh create db directory and correct path 3 years ago
launch_server.sh fix: [launcher] Removed hardcoded paths 4 years ago
requirements chg: [requirements] for the cof server added 4 years ago

README.md

analyzer-d4-passivedns

analyzer-d4-passivedns is an analyzer for a D4 network sensor. The analyser can process data produced by D4 sensors (in passivedns CSV format (more to come)) and ingest these into a Passive DNS server which can be queried later to search for the Passive DNS records.

Features

Overview

Requirements

  • Python 3
  • Redis >5.0
  • Tornado
  • iptools

Install

./install_server.sh

All the Python 3 code will be installed in a virtualenv (PDNSENV).

Running

Start the redis server

Don't forget to set the DB directory in the redis.conf configuration. By default, the redis for Passive DNS is running on TCP port 6400

./redis/src/redis-server ./etc/redis.conf

Start the Passive DNS COF server

. ./PDNSENV/bin/activate
cd ./bin/
python3 ./pdns-cof-server.py

Configure and start the D4 analyzer

cd ./etc
cp analyzer.conf.sample analyzer.conf

Edit the analyzer.conf to match the UUID of the analyzer queue from your D4 server.

[global]
my-uuid = 6072e072-bfaa-4395-9bb1-cdb3b470d715
d4-server = 127.0.0.1:6380
# INFO|DEBUG
logging-level = INFO

then you can start the analyzer which will fetch the data from the analyzer, parse it and populate the Passive DNS database.

. ./PDNSENV/bin/activate/
cd ./bin/
python3 pdns-ingestion.py

License

The software is free software/open source released under the GNU Affero General Public License version 3.