[Bro] Question about disable lookup_addr
bluebike.sjlee at gmail.com
Tue Oct 24 13:26:50 PDT 2017
I checked policy/frameworks/files/detect-MHR.bro, but does not able to fine
function for lookup_addr but seeing
- when ( local MHR_result = lookup_hostname_txt(hash_domain) )
Is this also related with dns lookup?
On Tue, Oct 24, 2017 at 3:45 PM, Seth Hall <seth at corelight.com> wrote:
> That script should only run if you are turning some notices into alarms.
> I suspect that the look ups you are seeing are due to something else. The
> two primary scripts that are probably causing DNS lookups are:
> On 24 Oct 2017, at 13:13, SJ Lee wrote:
>> Looking at reverse dns record, seeing a lot of record from the IDS sensor
>> And found bro calling lookup_addr function in few files.
>> I was trying to disable all lookup_addr function, but below files not able
>> to disable due to dependency issue.
>> Is here my question, is there any easy way to disable lookup_addr
>> OR restrict internal dns db ONLY not want to hit external dns server, is
>> there any way can do this?
>> 1) /opt/bro/share/bro/base/frameworks/notice/actions/pp-alarms.bro:
>> ( local h1name = lookup_addr(h1) )
>> when ( local h2name = lookup_addr(h2) )
>> when ( local h2name_ = lookup_addr(h2) )
>> 2) /opt/bro/share/bro/base/bif/bro.bif.bro:global lookup_addr:
>> function(host: addr ) : string ;
>> Bro mailing list
>> bro at bro-ids.org
> Seth Hall * Corelight, Inc * www.corelight.com
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro