d4-project / analyzer-d4-passivedns Goto Github PK

Reconnect to redis (LIST) of the D4 server if goes down

When I run command: python3 pdns-ingestion.py
then display:
2019-06-07 07:19:18,611 - pdns ingestor - INFO - Starting and using FIFO analyzer:8:ac45ea5c-be1b-46db-a0e1-50decb7d3c09 from D4 server
Traceback (most recent call last):
File "pdns-ingestion.py", line 96, in
l = d4_record_line.decode('UTF-8')
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xbf in position 2: invalid start byte

Add a notification system when a specific domain is seen or match a specific yara rule

From terminal:

$ dig google.com

; <<>> DiG 9.11.3-1ubuntu1.3-Ubuntu <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60926
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;google.com.			IN	A

;; ANSWER SECTION:
google.com.		23	IN	A	172.217.22.78

;; Query time: 19 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Tue Feb 11 17:55:59 CET 2020
;; MSG SIZE  rcvd: 55

From API:

{"time_first": 1581440159, "time_last": 1581440159, "count": 1, "rrtype": "A", "rrname": "google.com", "rdata": "172.217.22.7", "origin": "origin not configured"} 

Use the defined DIR variable instead of the project fully disclosed absolute path to issue the screen commands.