refractionpoint/templates

Configuration templates for LimaCharlie.

LimaCharlie Templates

Configuration templates for LimaCharlie.

The index.yaml top level file describes all the templates found within.

templates's Issues

Better filter for DNS request

Hi there,
with regards to this:

  vt-domains:
    name: vt-domains
    namespace: general
    detect:
      event: DNS_REQUEST
      metadata_rules:
        length of: true
        op: is greater than
        path: /
        value: 4
      op: lookup
      path: event/DOMAIN_NAME
      resource: lcr://api/vt

we should filter out the local DNS limacharlie requests, example below:

{
  "DNS_TYPE": 1,
  "DOMAIN_NAME": "b44ea958b5a9378f1a09c463f15490599311a2eb.15e6fce5-2e59-43d2-b3fa-0d08e07e6e2d.did.limacharlie.io",
  "IP_ADDRESS": "127.0.0.1",
  "MESSAGE_ID": 50147
}

Maybe:

  vt-domains:
    name: vt-domains
    namespace: general
    detect:
      event: DNS_REQUEST
      op: not
      rules:
        - path: event/DOMAIN_NAME
          value: limacharlie.io
          op: ends_with
      metadata_rules:
        length of: true
        op: is greater than
        path: /
        value: 4
      op: lookup
      path: event/DOMAIN_NAME
      resource: lcr://api/vt

This way should save a few requests to VT.