Responder: Block a "domain" observable via BIND RPZ DDNS update

[mhexp]

Request Type

Responder

I've built, tested and deployed a responder that takes a Hive observable of type "domain" and adds it to a BIND Response Policy Zone (RPZ), effectively blocking access to the hostname.

My use case involves creating an A record in the RPZ and answering queries with an internal IP that acts as quarantine so we can see which systems are trying to access observed and blocked hostnames.

The responder configuration items allow for setting the following parameters: DNS server IP, TSIG key name, TSIG key value, TSIG hash algorithm, RPZ zone name, and IP address to inject into responses.

I would like to submit this responder for inclusion into the project. I'm still working on attaining organizational approval to share this code.

[mhexp]

Oh in case anyone is waiting based on my initial issue text, I have organizational approval to share this code with the community. I'm hoping it helps others as the hive has been greatly useful to my CIRT.

[jeromeleonard]

thank you for your contribution