blue-infosec / top-dns

Top DNS Measurement for Bro

Top DNS Measurement

Overview

This script uses a built in probabalistic measurement mechanism in Bro to measure the top DNS requests (by type of query, i.e., CNAME, A, AAAA, etc) being done over a definable period of time. This is logged into a new log named "top_dns.log".

By using the probabalistic mechanism, it makes this task something that can be achieved in a memory efficient manner and loading this script shouldn't have any truly significant performance impact on most deployments.

Installation

bro-pkg refresh
bro-pkg install bro/corelight/top-dns

Configuration

If you would like to change the logging/measurement interval, use the following snippet (default is 15 minutes):

redef TopDNS::logging_interval = 1hr;

If you would like to log more or less than the default of 10 names for each query type, you can use the following snippet:

redef TopDNS::top_k = 20;

If you would like to add something like MX recore queries to be measured, you can add the following snippet:

redef TopDNS::records += {"MX"};

By default this package will measure based on the full domain. If you'd like measure based on trimming down to the "domain" (www.google.co.uk would be trimmed to google.co.uk), you can use the following snippet in local.bro:

redef TopDNS::use_trimmed_domain = T;