Store the dns client ips for each queried hostname #436
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added all uconns-based fields to hosts table on import
added check in analysis for uconn being created at import
Generate uconns and hosts at import
Create hostnames collection at import
…alysis to importer (#359)
* Adding an invalid cert field to uconn pair type, and we also parse invalid certs and set in the uconn map in fsimporter * added scoring to hosts for unique invalid certs if they are also beacons
… periods in the db names :p (#416)
* Remove old logic that directed imported files towards different databases based on subdirectories * Change help message for import to remove notes on subdirectories * Change DBRoot to DBName * Stop rita from recursively finding files
* Remove unused header from show-beacons -H * Ensure both human readable and csv output have the same headers for show-beacons
* updated upps count to unique for src-dst pair * fixed error where updating uconns/host/cert entries from log parsing other than conns caused issues because those entries were being filtered in conns
ethack
approved these changes
Mar 26, 2019
lisaSW
approved these changes
Apr 9, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Addresses issue #434.
I created an Input structure for hostnames which contains the IP addresses the matching hostname resolved to as well as the IP addresses that queried the hostname. I filled these structures out in the fsimporter and updated the analysis code to store the new data.