Skip to content

Latest commit

 

History

History
60 lines (52 loc) · 7.2 KB

README.md

File metadata and controls

60 lines (52 loc) · 7.2 KB
Raw

✨ Falco Plugin - DNS Collector ✨

This project is a falco plugin for the DNS Collector project (https://github.com/dmachard/go-dnscollector).

Supported Fields

Here is the current set of supported fields:

NAME TYPE ARG DESCRIPTION
dnscollector.network.family string None IP protocol version INET or INET6.
dnscollector.network.protocol string None Protocol UDP, TCP.
dnscollector.network.query-ip string None DNS query IP address.
dnscollector.network.query-port string None DNS query port.
dnscollector.network.response-ip string None DNS response IP address.
dnscollector.network.response-port string None DNS response port.
dnscollector.network.ip-defragmented string None IP-Fragmented.
dnscollector.network.tcp-reassembled string None TCP-Reassembled.
dnscollector.dns.length uint64 None Length of the query or response.
dnscollector.dns.opcode uint64 None DNS operation code (integer).
dnscollector.dns.rcode string None DNS return code.
dnscollector.dns.qname string None DNS query name.
dnscollector.dns.qtype string None DNS query type.
dnscollector.dns.flags.qr string None DNS query type value q/r.
dnscollector.dns.flags.tc string None DNS truncated response flag.
dnscollector.dns.flags.aa string None DNS authoritive response flag.
dnscollector.dns.flags.ra string None DNS recursion available flag.
dnscollector.dns.flags.ad string None DNS authenticated data flag.
dnscollector.dns.malformed-packet string None Malformed dns packet, integer value 1/0.
dnscollector.dns.repeated uint64 None DNS query repeated.
dnscollector.edns.udp-size uint64 None EDNS UDP size.
dnscollector.edns.rcode. uint64 None EDNS request code.
dnscollector.edns.version. uint64 None EDNS version.
dnscollector.edns.dnssec-ok. uint64 None EDNS DNSSEC_OK.
dnscollector.edns.options. string None EDNS options.
dnscollector.dnstap.operation string None DNStap pperation.
dnscollector.dnstap.identity string None DNStap identity.
dnscollector.dnstap.version string None DNStap version.
dnscollector.dnstap.latency string None Computed latency between queries and replies.
dnscollector.suspicious.score string None DNS calcualted suspicious score.
dnscollector.suspicious.malformed-pkt string None DNS suspicious malformed packet detected.
dnscollector.suspicious.large-pkt string None DNS suspicious large packet detected.
dnscollector.suspicious.long-domain string None DNS suspicious long domain detected.
dnscollector.suspicious.slow-domain string None DNS suspicious long domain detected.
dnscollector.suspicious.unallowed-chars string None DNS suspicious unallowed characters detected.
dnscollector.suspicious.uncommon-qtypes string None DNS suspicious uncommon query type detected.
dnscollector.suspicious.excessive-number-labels string None DNS suspicious excessive number of labels detected.

Configuration

falco.yaml Example

plugins:
  - name: dnscollector
    library_path: libdnscollector.so
    open_params: "http://:8888/events"
load_plugins: [dnscollector]