Hi,
I am playing around with Suricata v8.0 and I want to capture all DNS NXDOMAIN responses and see what the requested domains were that ended up having NXDOMAIN responses. I managed to create a rule that work perfectly, however, I want to extend my msg to show the actual queried domain - although my question basically generalizes to the question how to append, if possible, any variable to the msg.
The problem is that vetting the fast.log is easy, but the eve.log is getting huge quite fast and difficult to use for my simple use case. So, i have this rule:
# DNS NXDOMAIN response
alert dns any 53 -> any any \
(msg:"NXDOMAIN Response Detected"; \
flow:established,to_client; \
dns.rcode:NXDOMAIN; \
classtype:protocol-command-decode; \
metadata: prio medium ; \
sid:1000005; \
rev:7;)
This creates the alerts in the fast.log and also logs in eve.log. In the latter I can see all details based on the logging settings in suricata.yml including the requested domain. But I want to append this to my log msg. Is it possible?
I tried many different ways, but neither were resolved to the actual value, like using $dns.rrname, etc.
I bet it’s not possible, but wanted to give a try to ask, maybe I am just missing something. And I also want to understand why it is not possible, what the rationale is, because I am sure there is 