Alert Notification Popup Should Resolve IP Address To Hostname (DNS Record)

[BADJAG]

Hi, I'd like to propose a minor enhancement to the alert notification popup. In the "ADVANCED RULE SETTINGS" section of the popup, it'd be nice if the "TARGET" IP address resolved to a hostname as well. This would save the effort of having to look up the destination IP via traceroute or a reverse IP lookup on the web. Thanks.

[AtlasHackert]

The biggest problem with that is that reverse DNS isn't trustworthy; it's easy to forge the record, or have it display a wrong domain (there can be multiple domains associated with one IP). Showing information that can be wrong is a bad idea for security software.

That said: if somebody figures out a compromise, it's definitely something valuable to have.

[BADJAG]

Thanks for the quick reply. I guess using traceroute will have to do for the time being. It's more fun anyway. :-)

[wokhan]

Hi, This feature was implemented a while back but wasn't working everytime. It should still be there anyway… I don't remember disabling it :-) Thanks Khan

…

________________________________ De : BADJAG <notifications@github.com> Envoyé : Monday, July 23, 2018 12:23:28 AM À : wokhansoft/WFN Cc : Subscribed Objet : Re: [wokhansoft/WFN] Alert Notification Popup Should Resolve IP Address To Hostname (DNS Record) (#43) Thanks for the quick reply. I guess using traceroute will have to do for the time being. It's more fun anyway. :-) — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fwokhansoft%2FWFN%2Fissues%2F43%23issuecomment-406901763&data=02%7C01%7C%7C6e84202b8ea04cb172cc08d5f021c054%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636678950107741907&sdata=iYMlwjyKa8vOuPqxj3DnlKZNRAYk9h0c6RgsI%2BvOcyg%3D&reserved=0>, or mute the thread<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAXrQzVgYOURR7fNXkCj5ahFMeLgHmyECks5uJPtggaJpZM4VZ-Gz&data=02%7C01%7C%7C6e84202b8ea04cb172cc08d5f021c054%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636678950107741907&sdata=5TTs9NV42sGF3lepaMrNBQKt9YaFrXBnyXEkDx9s9rk%3D&reserved=0>.

[AtlasHackert]

I disabled it some time ago for two reasons: the one stated above, and the DNS lookup was itself triggering WFN notifications.

[wokhan]

Ok, makes sense :-) Sorry I missed this. Thank you

…

________________________________ De : DanielPharos <notifications@github.com> Envoyé : Tuesday, July 24, 2018 12:42:41 AM À : wokhansoft/WFN Cc : Jérôme Saliba; Comment Objet : Re: [wokhansoft/WFN] Alert Notification Popup Should Resolve IP Address To Hostname (DNS Record) (#43) I disabled it some time ago for two reasons: the one stated above, and the DNS lookup was itself triggering WFN notifications. — You are receiving this because you commented. Reply to this email directly, view it on GitHub<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fwokhansoft%2FWFN%2Fissues%2F43%23issuecomment-407224131&data=02%7C01%7C%7C0b5706c97bac4b86154a08d5f0ed99d7%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636679825628871127&sdata=cSFbSn39hkK0%2F5oT7HzZK1WbvuHb6OJnvHxzkxZJobM%3D&reserved=0>, or mute the thread<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAXrQzVu9OjL8c8hyP4Py-eesEii4eU5Bks5uJlFhgaJpZM4VZ-Gz&data=02%7C01%7C%7C0b5706c97bac4b86154a08d5f0ed99d7%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636679825628881138&sdata=Z68Dn%2F8yZYv1ut1f%2BlDu4KbNtXGafSliLrESqPaxjd0%3D&reserved=0>.

[harrwiss]

This is in the pipeline - implemented a DNS resolver working in the background. Currently working on integration with SecurityLog and then maybe Map and Connections

[harrwiss]

DNS Resolver is implemented for Security Log, Connections, Map and Notifier (tooltip on Target IP option). However today there are many host IP's which have no DNS entry resulting in No such host is known when resolved. If you click on the Target IP link in Notifier it will do a lookup on an online service to get more details.

Note: Just noticed, that clicking on the Target IP link in Notifier crashes in the netcore3 version.

[wokhan]

Any crashing with netcore31 should be due to missing assemblies (since they are now pulled from nuget). Hopefully 😁

[harrwiss]

Crash fixed with #76

[harrwiss]

Btw: The TargetInfoUrl and TargetPortUrl for the online service to use can be configured in the settings config file.