Skip to content
DoveHawk Passive DNS Collector Module for Zeek
Zeek
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
scripts
.gitignore
LICENSE
README.md
__load__.bro
bro-pkg.meta
config.bro

README.md

Dovehawk.io Passive DNS Collector Module for Zeek

This module colects DNS requested names and multiple answers across an entire Cluster or Standalone Zeek instance. The requestor is not tracked and SUMSTATS is used to aggregate multiple requests over a specified time period anonymizing the requests.

Local hostnames are stripped to further anonymize the data for external sharing.

Sticker 1 Sticker 2

Screencaps

DoveHawk pDNS Reported

Dovehawk pDNS Reports

DoveHawk pdns.log Local Log

Dovehawk pDNS Log

Requirements

Zeek > 2.6.1 (Some 2.5 versions may work but testing showed issues with triggering the SUMSTATS finished epoch).

Curl command line version used by ActiveHTTP

Database

See dovehawk_lambda for an AWS Lambda serverless function to store reporting in RDS Aurora.

Contact

Tyler McLellan @tylabs

You can’t perform that action at this time.