Public DNS Feed

A feed of known benign IPs of public DNS servers.

Data Enrichment & Threat Intelligence · Public DNS Feed · Feed

Details

IDPublic DNS Feed
ProviderOpen Source
CategoryData Enrichment & Threat Intelligence
From Version5.5.0
Docker Imagedemisto/netutils:1.0.0.10187688
Supported ModulesAgentix XSIAM

README

A feed of known benign IPs of public DNS servers.

Configure Public DNS Feed in Cortex

Parameter Description Required
url Public DNS feed URL True
feed Fetch indicators False
feedReputation Indicator Reputation False
feedReliability Source Reliability True
feedExpirationPolicy   False
feedFetchInterval Feed Fetch Interval False
feedExpirationInterval   False
feedTags Tags False
feedBypassExclusionList Bypass exclusion list False
tlp_color Traffic Light Protocol Color False
Enrichment Excluded Select this option to exclude the fetched indicators from the enrichment process. False
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

public-dns-get-indicators

Gets indicators from the feed.

Base Command

public-dns-get-indicators

Input

Argument Name Description Required
limit The maximum number of results to return. The default value is 10. Default is 10. Optional

Context Output

There is no context output for this command.

Command Example

!public-dns-get-indicators limit=2

Context Example

{
    "Indicator": [
        {
            "rawJSON": {
                "type": "IPv6",
                "value": "2607:5300:203:1797::53"
            },
            "score": 0,
            "type": "IPv6",
            "value": "2607:5300:203:1797::53"
        },
        {
            "rawJSON": {
                "type": "Ip",
                "value": "199.255.137.34"
            },
            "score": 0,
            "type": "Ip",
            "value": "199.255.137.34"
        }
    ]
}

Human Readable Output

Public DNS Feed

value type
2607:5300:203:1797::53 IPv6
199.255.137.34 Ip

Configuration parameters

  • url — Public DNS feed URL (required)
  • feed — Fetch indicators
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • feedExpirationPolicy —
  • feedFetchInterval — Feed Fetch Interval
  • feedExpirationInterval —
  • feedTags — Tags
  • feedBypassExclusionList — Bypass exclusion list
  • tlp_color — Traffic Light Protocol Color
  • enrichmentExcluded — Enrichment Excluded
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (1)

  • public-dns-get-indicators

    Gets indicators from the feed.

Source

FeedPublicDNS.py FeedPublicDNS_test.py FeedPublicDNS.yml
Download History Raw 
import pytest
from FeedPublicDNS import Client, fetch_indicators_command


@pytest.mark.parametrize("enrichment_excluded", [True, False])
def test_fetch_indicators_command(requests_mock, enrichment_excluded):
    """
    Given:
    When:
    Then:
    """
    expected = [
        {
            "value": "192.168.0.1",
            "type": "IP",
            "rawJSON": {"value": "192.168.0.1", "type": "IP"},
            "fields": {"tags": ["test"], "trafficlightprotocol": "test color"},
        },
        {
            "value": "10.0.0.1",
            "type": "IP",
            "rawJSON": {"value": "10.0.0.1", "type": "IP"},
            "fields": {"tags": ["test"], "trafficlightprotocol": "test color"},
        },
    ]
    if enrichment_excluded:
        for ind in expected:
            ind["enrichmentExcluded"] = True

    url = "https://public-dns.info/nameservers-all.txt"
    mock_response = "192.168.0.1\n10.0.0.1"
    requests_mock.get(url, text=mock_response)

    client = Client(url, tags=["test"], tlp_color="test color")

    indicators = fetch_indicators_command(client, enrichment_excluded=enrichment_excluded)

    assert indicators == expected