Repository navigation
Add generic DNS resource record object with full RDATA and pivots - #549
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 52c16f18b2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| }, | ||
| "queried-name": { | ||
| "description": "Absolute DNS query name, without the final root dot. May differ from rrname when aliases are followed.", | ||
| "misp-attribute": "domain", |
There was a problem hiding this comment.
For root (.), single-label, or escaped query names, this required attribute cannot be created: MISP strips terminal dots from domain values and then validates them as a dotted name with a multi-character final label (MISP validator). A root query therefore becomes an empty invalid value, while other valid DNS names such as localhost are also rejected, preventing this otherwise generic resource-record object from representing their responses. Use text here, as already done for rrname, or otherwise provide a required representation that supports the full DNS name syntax.
Useful? React with 👍 / 👎.
1 participant
The existing dns-record object groups selected record types and cannot represent arbitrary active DNS records with their owner, TTL and full RDATA. Add dns-resource-record for a single observed resource record, including query names, owner, type, class, response sections and complete presentation-format data.
Typed domain, IP/network, email, SOA mailbox, URL, service and SOA timing fields support correlation while retaining the original data. Owner names use text to preserve root, wildcard and escaped names. Generated data defaults to to_ids=false; administrative metadata disables correlation. Object first_seen/last_seen describe observation time.
The companion dns_query expansion in MISP/misp-modules#943 bundles an identical definition, so it can run before a PyMISP template update. This adds a new template and its catalog entry without changing existing templates.
Validation: checked against this repository's schema_objects.json, canonical sorted JSON, UUID uniqueness against the installed catalog, and strict PyMISP object validation. The companion module's focused DNS suites pass 156 tests, including a local UDP DNS server exercising actual wire parsing. The full misp-objects validation suite remains for CI.