Skip to content

dns-cache-entry.md

Latest commit

 

History

History
31 lines (22 loc) · 843 Bytes

dns-cache-entry.md

File metadata and controls

31 lines (22 loc) · 843 Bytes
Raw

DNS cache entry

Schema ID: https://github.com/NextronSystems/jsonlog/thorlog/v3/dns-cache-entry | JSON Schema: https://json-schema.org/draft/2020-12/schema | Definition: DnsCacheEntry

Fields

Field names are shown in UPPERCASE as used in Sigma rules. The lowercase JSON name is shown in parentheses for reference.

Sigma Field JSON Name Type Required Description Example Values
HOST host string ✅
IP ip string ✅
TYPE type string ✅

No nested fields in this type.

Sigma Rule Template

logsource:
    product: THOR
    service: "DNS cache entry"

detection:
    selection:
        IP: '192.168.1.100'
    condition: selection

level: medium