Cisco Umbrella Domain Name Fuzzy Matching

AnalysisType: rule
Filename: fuzzy_matching_domains.py
RuleID: "CiscoUmbrella.DNS.FuzzyMatching"
DisplayName: "Cisco Umbrella Domain Name Fuzzy Matching"
Enabled: false
DedupPeriodMinutes: 15
LogTypes:
  - CiscoUmbrella.DNS
Tags:
  - Configuration Required
  - DNS
Reference: https://umbrella.cisco.com/blog/abcs-of-dns
Severity: Medium
Description: Identify lookups to suspicious domains that could indicate a phishing attack.
Runbook: |
  Validate if your organization owns the domain, otherwise investigate the host that made
  the domain resolution.

# Tests:
#   -
#     Name: Phishing Domain
#     ExpectedResult: true
#     Log:
#       {}


# ------ paired body: fuzzy_matching_domains.py ------

from difflib import SequenceMatcher

DOMAIN = ""  # The domain to monitor for phishing, for example "google.com"
ALLOW_SET = {
    # List all of your known-good domains here
}
SIMILARITY_RATIO = 0.70


def rule(event):
    # Domains coming through umbrella end with a dot, such as google.com.
    domain = ".".join(event.get("domain").rstrip(".").split(".")[-2:]).lower()

    return (
        domain not in ALLOW_SET
        and SequenceMatcher(None, DOMAIN, domain).ratio() >= SIMILARITY_RATIO
    )


def title(event):
    return f"Suspicious DNS resolution to {event.get('domain')}"