revDNS is a passive host information collector written for NSM platforms ingesting data from Bro IDS.
revDNS builds a passive database of reverse DNS information from DNS, SSL and HTTP metadata ingested from bro logs.
It currently supports ingesting data from Kafka and provides a REST interface to lookup information using IP.
go get github.com/gviz/revDNS/...
revDNS reads its configuraiton from revdns.yaml.
> api:
>> port: 9090
>
>input:
>> type: "kafka"
>> host: "localhost:9092"
>> topic: "bro-raw"
>> stream_dns: "dns"
>> stream_ssl: "ssl"
>> stream_http: "http"
> go run github.com/gviz/revDNS/revDNS.go
> curl http://localhost:9090/revdns/api/v1/ip/<IP Address>
The contents of this repository are covered under the GPL V3 License.