AnalysisType: rule
Filename: domain_blocked.py
RuleID: "CiscoUmbrella.DNS.Blocked"
DisplayName: "Cisco Umbrella Domain Blocked"
Enabled: true
DedupPeriodMinutes: 480 # 8 hours
LogTypes:
- CiscoUmbrella.DNS
Tags:
- DNS
Severity: Low
Description: Monitor blocked domains
Runbook: Inspect the blocked domain and lookup for malware
Reference: https://support.umbrella.com/hc/en-us/articles/230563627-How-to-determine-if-a-domain-or-resource-is-being-blocked-using-Chrome-Net-Internals
SummaryAttributes:
- action
- internalIp
- externalIp
- domain
- responseCode
Tests:
- Name: Domain Blocked
ExpectedResult: true
Log:
{
"action": "Blocked",
"internalIp": "136.24.229.58",
"externalIp": "136.24.229.58",
"timestamp": "2020-05-21 19:20:25.000",
"responseCode": "NOERROR",
"domain": "malware.gvt2.com.",
}
- Name: Action Allowed
ExpectedResult: false
Log:
{
"action": "Allowed",
"internalIp": "136.24.229.58",
"externalIp": "136.24.229.58",
"timestamp": "2020-05-21 19:20:25.000",
"responseCode": "NOERROR",
"domain": "beacons3.gvt2.com.",
}
# ------ paired body: domain_blocked.py ------
def rule(event):
return event.get("action") == "Blocked"
def title(event):
return "Access denied to domain " + event.get("domain", "<UNKNOWN_DOMAIN>")