[Bro] A little more confusion with Intel

Jan Grashöfer jan.grashoefer at gmail.com
Thu Feb 1 11:34:51 PST 2018


On 01/02/18 19:09, Seth Hall wrote:
>> Friendly reminder: https://github.com/J-Gras/intel-seen-more ;)
> 
> Hahaha!  Sorry, I forgot about that already!
> 
> I had a thought about it too, what do you think about changing 
> Intel::EFFECTIVE_DOMAIN to Intel::EFFECTIVE_TLD?   Seems like it makes 
> sense since the TLD is what you end up matching with this and it fits 
> James' use case correctly.

To be honest, I just wrote the POC down without giving a thought to 
naming. Quick recap: In the example of "www.yahoo.com", the TLD is 
".com". For "www.yahoo.co.uk" the TLD is ".uk". Now you introduced the 
package to obtain the 'effective TLD', which would be ".co.uk" - 
technically a 2nd-level domain. But actually, we want to match against 
"yahoo.co.uk". Maybe one could call that the 'effective SLD/2LD'. So in 
case of changing, I would tend to use Intel::EFFECTIVE_SLD. However, to 
me this seems a bit counter intuitive.

Jan


More information about the Bro mailing list