mirror of
https://github.com/vimagick/dockerfiles.git
synced 2024-12-23 01:39:27 +02:00
91 lines
1.7 KiB
Markdown
91 lines
1.7 KiB
Markdown
passivedns
|
|
==========
|
|
|
|
[PassiveDNS][1] is a tool to collect DNS records passively to aid Incident handling, Network
|
|
Security Monitoring (NSM) and general digital forensics.
|
|
|
|
## docker-compose.yml
|
|
|
|
```yaml
|
|
version: "3.8"
|
|
services:
|
|
passivedns:
|
|
image: vimagick/passivedns
|
|
command: >
|
|
-i eth0
|
|
-l /var/log/passivedns/passivedns.log
|
|
-L /var/log/passivedns/passivedns-nx.log
|
|
-p /var/run/passivedns.pid
|
|
-P 86400
|
|
-S 256
|
|
-X 46CDNOPRSTMnx
|
|
volumes:
|
|
- ./data:/var/log/passivedns
|
|
network_mode: host
|
|
privileged: true
|
|
restart: unless-stopped
|
|
```
|
|
|
|
## filebeat.yml
|
|
|
|
```yaml
|
|
filebeat.inputs:
|
|
- type: filestream
|
|
id: passivedns
|
|
paths:
|
|
- /path/to/passivedns/data/passivedns.log
|
|
- /path/to/passivedns/data/passivedns-nx.log
|
|
ignore_inactive: since_first_start
|
|
fields:
|
|
project: dns
|
|
fields_under_root: true
|
|
processors:
|
|
- include_fields:
|
|
fields: ["message", "project"]
|
|
|
|
output.logstash:
|
|
hosts: ["logstash:5044"]
|
|
```
|
|
|
|
## logstash.conf
|
|
|
|
```
|
|
input {
|
|
beats {
|
|
port => 5044
|
|
}
|
|
}
|
|
|
|
filter {
|
|
if [project] == "dns" {
|
|
csv {
|
|
separator => "||"
|
|
columns => [ "timestamp", "client", "server", "class", "query", "type", "answer", "ttl", "count" ]
|
|
convert => {
|
|
"ttl" => "integer"
|
|
"count" => "integer"
|
|
}
|
|
}
|
|
date {
|
|
match => [ "timestamp", "UNIX" ]
|
|
remove_field => [ "timestamp" ]
|
|
}
|
|
mutate {
|
|
gsub => [ "query", "\.$", "", "answer", "\.$", "" ]
|
|
remove_field => [ "[host]", "[agent]", "[ecs][version]", "message" ]
|
|
}
|
|
} else {
|
|
drop {}
|
|
}
|
|
}
|
|
|
|
output {
|
|
elasticsearch {
|
|
hosts => ["elasticsearch:9200"]
|
|
ilm_enabled => "false"
|
|
}
|
|
}
|
|
```
|
|
|
|
[1]: https://github.com/gamelinux/passivedns
|