[Oisf-users] Domain reputation in suricata

Jay M. jskier at gmail.com
Tue Feb 10 19:14:32 UTC 2015


Is domain reputation available is suricata? I'm using iprep without
issue, but would probably get more accuracy out of domain reputation
list for what I need.

I haven't had time to see if the same configuration options work for
domain rep, I assume it would if I made similar to iprep rules for
http.hostname instead of src and dst?

If anyone has any suggestions or documentation from experience, please
let me know (can't seem to find any documentation on domain, only ip).


jskier at gmail.com

More information about the Oisf-users mailing list