Repository navigation
Add comprehensive DNS record enumeration and pivot enrichment - #943
Merged
Merged
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add dns_query, a separate expansion module for collecting DNS pivots beyond the existing A/AAAA resolver. It explicitly queries all dnspython-known data types (74 with dnspython 2.8.0), including SOA, TXT, MX, NS, SRV, CAA, service bindings and DNSSEC, with optional type selection and private TYPE codes.
Accept domains, hostnames, URLs, emails, supported composites and IPv4/IPv6 inputs (reverse names). Preserve complete RDATA, actual owner, class, TTL and response sections in linked dns-resource-record objects. Keep aliases, negative-answer SOA records and additional glue with their own owners. Extract domain/IP/email/URL pivots, SOA mailbox and timings, SPF networks, and service parameters. Preserve the source attribute UUID and metadata; generated attributes use to_ids=false.
Eight workers share a configurable total DNS budget. Mail-policy TXT queries and one bounded A/AAAA follow-up stage collect further pivots; result and follow-up limits prevent unbounded expansion. Partial failures retain records with diagnostic comments. This enumerates types at known names, not every owner in a DNS zone; it excludes ANY, transfers, meta/authentication types and recursive crawling.
The new generic object template is proposed in MISP/misp-objects#549 and bundled identically here for PyMISP compatibility. MISP administrators must import/update that template server-side. README and JSON documentation cover configuration, deployment and limitations.
Validation: 156 tests passed across tests/test_dns_query.py, tests/test_dns.py and tests/test_url_dns.py (82 new module tests). Includes a local UDP DNS server exercising real dnspython Answer/RRset parsing and EDNS DNSSEC OK. Strict PyMISP validation, upstream object schema, module discovery, Black, isort, flake8 and wheel build/content checks passed. Public DNS and deployment into a running MISP instance have not been tested.