[Bro] A little more confusion with Intel
Jan Grashöfer
jan.grashoefer at gmail.com
Thu Feb 1 11:34:51 PST 2018
On 01/02/18 19:09, Seth Hall wrote:
>> Friendly reminder: https://github.com/J-Gras/intel-seen-more ;)
>
> Hahaha! Sorry, I forgot about that already!
>
> I had a thought about it too, what do you think about changing
> Intel::EFFECTIVE_DOMAIN to Intel::EFFECTIVE_TLD? Seems like it makes
> sense since the TLD is what you end up matching with this and it fits
> James' use case correctly.
To be honest, I just wrote the POC down without giving a thought to
naming. Quick recap: In the example of "www.yahoo.com", the TLD is
".com". For "www.yahoo.co.uk" the TLD is ".uk". Now you introduced the
package to obtain the 'effective TLD', which would be ".co.uk" -
technically a 2nd-level domain. But actually, we want to match against
"yahoo.co.uk". Maybe one could call that the 'effective SLD/2LD'. So in
case of changing, I would tend to use Intel::EFFECTIVE_SLD. However, to
me this seems a bit counter intuitive.
Jan
More information about the Bro
mailing list