SafeNetworking’s DNS enrichment module automatically processes DNS threat events from your firewall, enriching them with threat intelligence from Palo Alto Networks AutoFocus. The system classifies threats by campaign, actor, or malware family, and assigns confidence scores based on sample age and tag relevance.
When DNS threat events arrive in Elasticsearch, the unprocessedEventSearch() function queries for unprocessed events tagged as “DNS” and classifies them into two categories:
Primary Events
Domain already exists in local cache (sfn-domain-details index). These are processed immediately with cached threat intelligence.
Secondary Events
Domain not in cache. Requires AutoFocus API lookup to retrieve threat intelligence before processing.
The getDomainDoc() function manages the domain cache and AutoFocus queries:
# From dnsutils.py:462-520def getDomainDoc(domainName): timeLimit = (datetime.datetime.now() - datetime.timedelta(days=app.config['DNS_DOMAIN_INFO_MAX_AGE'])) try: domainDoc = DomainDetailsDoc.get(id=domainName) # Check if cache is stale if timeLimit > domainDoc.doc_updated: updateDetails = True except NotFoundError: # Domain not cached - query AutoFocus updateDetails = True if updateDetails: afDomainData = getDomainInfo(domainName) domainDoc = DomainDetailsDoc(meta={'id': domainName}, name=domainName) domainDoc.tags = afDomainData domainDoc.save() return domainDoc
Domain cache entries expire after DNS_DOMAIN_INFO_MAX_AGE days (default: 30). This ensures threat intelligence stays current while minimizing API calls.
The assessTags() function analyzes AutoFocus tags to determine the most relevant threat classification:
# From dnsutils.py:243-340def assessTags(tagsObj): # Priority order: Campaign > Actor > Malware Family for entry in tagsObj: for tag in entry[2]: tagClass = tag[2] if tagClass == "campaign": # Highest priority - immediate return tagInfo = {"confidence_level": 90, ...} return tagInfo elif tagClass == "actor": tagInfo = {"confidence_level": 90, ...} # Continue checking for campaigns elif tagClass == "malware_family": # Calculate confidence based on sample age dateDiff = (datetime.datetime.now() - datetime.datetime.strptime(sampleDate, "%Y-%m-%dT%H:%M:%S")) for days in tagConfLevels: if dateDiff.days < int(days): confLevel = tagConfLevels[days] break
The processDNS() function uses Python’s multiprocessing to handle events efficiently:
# From runner.py:75-107def processDNS(): priDocIds, secDocIds = unprocessedEventSearch() # Cap at 16 processes to respect AutoFocus API rate limits multiProcNum = app.config['DNS_POOL_COUNT'] if app.config['DNS_POOL_COUNT'] <= 16 else 16 # Process primary events (cached domains) with Pool(multiProcNum) as pool: results = pool.map(searchDomain, priDocIds) # Process secondary events (new domains) with Pool(multiProcNum) as pool: results = pool.map(searchDomain, secDocIds)
AutoFocus API Rate Limits: The system automatically caps concurrent processes at 16 to avoid exceeding AutoFocus minute bucket limits (200 points/minute). Each domain lookup consumes 10-14 API points.
Configure DNS processing behavior in your .panrc file:
# Number of processes for concurrent DNS lookups (max 16)DNS_POOL_COUNT = 16# Number of events to query per batchDNS_EVENT_QUERY_SIZE = 1000# Domain cache expiration (days)DNS_DOMAIN_INFO_MAX_AGE = 30# Tag cache expiration (days)DOMAIN_TAG_INFO_MAX_AGE = 120# AutoFocus query timeout (minutes)AF_LOOKUP_TIMEOUT = 2# Minimum completion percentage for AutoFocus queriesAF_LOOKUP_MAX_PERCENTAGE = 20# AutoFocus API point managementAF_POINTS_LOW = 5000 # Slow down when points drop below thisAF_POINT_NOEXEC = 500 # Stop processing below this thresholdAF_NOEXEC_CKTIME = 3600 # Seconds to wait before rechecking points# Confidence level thresholds (days:percentage)CONFIDENCE_LEVELS = "{'15':90,'25':80,'40':70,'50':60,'60':50}"# Processing interval (seconds between runs)DNS_POOL_TIME = 5
