1type: leaky
2name: mstilkerich/bind9-refused
3description: "Act on queries / zone transfers denied by bind9 policy"
4debug: false
5filter: "evt.Meta.log_type == 'bind9_denied'"
6groupby: evt.Meta.source_ip
7capacity: 5
8leakspeed: 10s
9blackhole: 1m
10labels:
11  service: domain
12  classification:
13    - attack.T1590.002
14  spoofable: 0
15  confidence: 3
16  behavior: "generic:scan"
17  label: "Domain transfer attempt"
18  remediation: true
19