How to use getwatchlist and lookup to find malware domains in DNS logs?

[packet_hunter]

Scenario: I am trying to check my DNS logs for queries to malicious domains on the getwatchlist [http://mirror1.malwaredomains.com/files/domains.txt].

So far I have reformatted my DNS queries (e.g. from: (14)registerdisney(2)go(3)com(0) to: registerdisney.go.com) with the following code

index=DNSlogs | eval reformattedDomain = replace(replace(questionname,"\(\d+\)","."),"\.(.*)\.","\1") | stats list(*)

Now I need to correlate my [reformattedDomain] to the [domain] field in malware_domainsdm.csv and the following code works:

|getwatchlist malwaredomains | outputlookup malware_domainsdm.csv

I get these fields [ domain, category, reference, date] however I am not finding the right syntax to make the connection.

Please provide any examples.

Thank you!

[dshpritz · Accepted solution]

You can try adding something like this to the end of your search:

| lookup malware_domainsdm.csv domain AS reformattedDomain | search category=*

which would perform the lookup against the downloaded list, using the reformattedDomain as the key against the values in the domain field. Then the search command filters the results to only show the items for which the lookup was successful. You may not want the stats portion of the search you have in your search.

HTH,

Dave

[packet_hunter]

index=msad | eval reformattedDomain = replace(replace(questionname,"\(\d+\)","."),"\.(.*)\.","\1")
|stats count by reformattedDomain 
|lookup malware_domainsdm.csv domain AS reformattedDomain  
| eval domainmatch=if(reformatedDomain==domain, "bad", "good")

This gets me closer but I am having trouble populating the other malwaredomaindm.csv fields like category, date, and reference. Any ideas?

Thank you

[packet_hunter]

Thanks Dave, before I accept, do you know how to write an [eval domainmatch = if (reformattedDomain = domain) then add a value of good or bad in a new domain field?

Thanks

[dshpritz]

I think you want something like:

| eval domainmatch=if(reformatedDomain==domain, "bad", "good") 

You could also try:

| eval if(isnull(category), "good", "bad")