rdns Postoverflow by crowdsecurity | CrowdSec Hub

rdns

Postoverflow

By: crowdsecurity
Version: 0.4

Lookup the DNS associated to the source IP only for overflows

Install with a top-level collection

7 collections include it

sudo cscli collections install crowdsecurity/discord-crawler-whitelist

Installs 0 parser and 0 scenario.

View Discord - Crawler Whitelist →

Installation

sudo cscli postoverflows install crowdsecurity/rdns

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

postoverflows/s00-enrich/crowdsecurity/rdns.yaml· 9 linesGitHub

1onsuccess: next_stage
2filter: "evt.Overflow.Alert.GetScope() == 'Ip'"1
3name: crowdsecurity/rdns
4description: "Lookup the DNS associated to the source IP only for overflows"
5statics:
6  - method: reverse_dns
7    expression: evt.Overflow.Alert.Source.IP
8  - meta: reverse_dns
9    expression: evt.Enriched.reverse_dns

Installed on

Know where it runs

Sign in to see the Security Engines that run this postoverflow, the version they run and whether it was modified locally.

Documentation

Rdns enricher

This will use reverse_dns method to enrich an event with the reverse dns of the IP if it exists.