whalebone/wb-docs

wb-docs's Issues

Add note passivedns service needs to be restarted if network config changes

passivedns service needs to be restarted if ip or iface changes on the fly

hos/link to policies in docs

Add link to policies in the documentation here: https://docs.whalebone.io/en/hos/local_resolver.html#security-policies

Policies are here: https://docs.whalebone.io/en/hos/local_resolver.html#security-policies

port 53 towards resolver

include port 53 towards the resolver in the documentation

Tips and tricks for dashboard filtering

There are couple of useful formulas that an user can use for dashboard filtering, e.g.

• accu:[50 TO 60]
• accu:[50 TO *]
  etc.

For an advanced filtering the WB doc could document (in a tip & tricks section) the particular filter above (as it might be very useful) and document possible parameter names (like 'accu' in this case, standing for "Score" column).

Add section on how to use portal

Docs should include section describing how to use portal and how are all the things connected and a general how to for using Whalebone, for example

• ip ranges and their relation to sinkhole
• resolver configuration and how long till it propagates to resolver
• resolver configuration and it's effects
• traffic tools like virustotal, google, serach
• ....

Update content Filtering categories

allow localhost network communication

Allow network communication between processes on localhost like this
iptables -A INPUT -s 127.0.0.1 -j ACCEPT

Document Syslog Integration

Update Allow/Deny lists

recommended security policies

Describe recommended policies for different segments and include warning against applying to low blocking threshold

enable prometheus metrics

modules.load('http')
function startHttp ()
  net.listen('127.0.0.1', 8453, { kind = 'webmgmt' })
end
pcall(startHttp)

Cannot Find Zabbix SNMP Template

on this link https://docs.whalebone.io/en/latest/snmp_monitoring.html
cannot find .yaml zabbix template

On Debian 9 install curl

curl has to be installed before the resolver installation, as it is not included in default system packages. Add this as a tip to the docs

fulltext filter syntax

add fulltext filter syntax with examples for threats and dns data