DNSSinkhole analyzer

analyzers/DNSSinkhole/DNSSinkhole.json

@@ -0,0 +1,27 @@
+{
+  "name": "DNSSinkhole",
+  "author": "Andrea Garavaglia, LDO-CERT",
+  "license": "AGPL-V3",
+  "url": "https://github.com/LDO-CERT/cortex-analyzer",
+  "version": "1.0",
+  "description": "Check if a  domain is sinkholed via DNS Sinkhole server",
+  "dataTypeList": ["domain"],
+  "command": "DNSSinkhole/dnssinkhole.py",
+  "baseConfig": "DNSSinkhole",
+  "configurationItems": [
+    {
+      "name": "ip",
+      "description": "Define the DNS Sinkhole Server IP",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "sink_ip",
+      "description": "Define the sinkholed response address IP",
+      "required": true,
+      "multi": false,
+      "type": "string"
+    }
+  ]
+}

analyzers/DNSSinkhole/dnssinkhole.py

@@ -0,0 +1,45 @@
+#!/usr/bin/env python
+import dns.resolver
+from cortexutils.analyzer import Analyzer
+
+
+class DNSSinkholeAnalyzer(Analyzer):
+    def __init__(self):
+        Analyzer.__init__(self)
+
+        if self.data_type != 'domain':
+            self.error('DNSSinkhole Analyzer only usable with domain data type.')
+
+        self.resolver = dns.resolver.Resolver()
+        self.resolver.nameservers = [self.get_param('config.ip', None, 'Bind IP server needed for querying Sinkhole.')]
+        self.data = self.get_data()
+
+    def query(self):
+        try:
+            out = self.resolver.query(self.data)
+            dns_records = [ip.address for ip in out]
+        except dns.exception.DNSException as e :
+            dns_records = []
+        if self.get_param('config.sink_ip', '127.0.0.2') in dns_records:
+            return True
+        return False
+
+    def run(self):
+        self.report({
+            "is_sinkhole": self.query()
+        })
+
+    def summary(self, raw):
+        taxonomies = []
+
+        if raw.get('is_sinkhole'):
+            taxonomies.append(self.build_taxonomy('malicious', 'DNSSinkhole', 'IsSinkhole', 'True'))
+        else:
+            taxonomies.append(self.build_taxonomy('info', 'DNSSinkhole', 'IsSinkhole', 'False'))
+        return {
+            "taxonomies": taxonomies
+        }
+
+
+if __name__ == '__main__':
+    DNSSinkholeAnalyzer().run()

analyzers/DNSSinkhole/requirements.txt

@@ -0,0 +1,2 @@
+cortexutils
+dnspython

thehive-templates/DNSSinkhole_1_0/long.html

@@ -0,0 +1,30 @@
+<div class="panel panel-info" ng-if="success">
+    <div class="panel-heading">
+        DNSSinkhole information for <strong>{{artifact.data}}</strong>
+    </div>
+    <div class="panel-body">
+      <dl class="dl-horizontal">
+        <dt>Status</dt>
+        <dd>
+            <p style="font-size: 1.5em;">
+                <span class="label label-danger" ng-if="content.is_sinkhole">
+                    IP is sinkholed.
+                </span>
+                <span class="label label-info" ng-if="!content.is_sinkhole">
+                    IP is <strong>not</strong> sinkholed.
+                </span>
+            </p>
+        </dd>
+      </dl>
+    </div>
+</div>
+
+<!-- General error -->
+<div class="panel panel-danger" ng-if="!success">
+    <div class="panel-heading">
+        <strong>{{(artifact.data || artifact.attachment.name) | fang}}</strong>
+    </div>
+    <div class="panel-body">
+        {{content.errorMessage}}
+    </div>
+</div>

thehive-templates/DNSSinkhole_1_0/short.html

@@ -0,0 +1,3 @@
+<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
+    {{t.namespace}}:{{t.predicate}}="{{t.value}}"
+</span>