Cisco Umbrella Suspicious Domains

AnalysisType: rule
Filename: suspicious_domains.py
RuleID: "CiscoUmbrella.DNS.Suspicious"
DisplayName: "Cisco Umbrella Suspicious Domains"
Enabled: false
DedupPeriodMinutes: 480 # 8 hours
LogTypes:
  - CiscoUmbrella.DNS
Tags:
  - DNS
  - Configuration Required
Reference: https://umbrella.cisco.com/blog/abcs-of-dns
Severity: Low
Description: Monitor suspicious or known malicious domains
Runbook: Inspect the domain and check the host for other indicators of compromise
SummaryAttributes:
  - action
  - internalIp
  - externalIp
  - domain
  - responseCode
Tests:
  - Name: Suspicious Domain
    ExpectedResult: true
    Log:
      {
        "action": "Allow",
        "internalIp": "136.24.229.58",
        "externalIp": "136.24.229.58",
        "timestamp": "2020-05-21 19:20:25.000",
        "responseCode": "NOERROR",
        "domain": "cron.photoscape.ch.",
      }
  - Name: Safe Domain
    ExpectedResult: false
    Log:
      {
        "action": "Allowed",
        "internalIp": "136.24.229.58",
        "externalIp": "136.24.229.58",
        "timestamp": "2020-05-21 19:20:25.000",
        "responseCode": "NOERROR",
        "domain": "google.com.",
      }


# ------ paired body: suspicious_domains.py ------

DOMAINS_TO_MONITOR = {"photoscape.ch"}  # Sample malware domain


def rule(event):
    return any(domain in event.get("domain") for domain in DOMAINS_TO_MONITOR)


def title(event):
    return "Suspicious lookup to domain " + event.get("domain", "<UNKNOWN_DOMAIN>")