Programmatically filter unusual DNS Requests with Cisco Umbrella APIs
We use the Web in our on a regular basis lives to get work achieved, handle our lives, and even socialize. We take this Web utilization without any consideration lately, however the actuality is that we’re speaking greater than ever on a worldwide scale, instantaneously, and sometimes, with people we’ve by no means met in-person or with third-party companies we don’t absolutely perceive.
From a cybersecurity perspective, this seems like a number of DNS site visitors to have to observe, perceive, and examine. And, there are rising causes to just do that. After the key Colonial Pipeline ransomware assault that resulted in a $4.4 million ransom cost in 2021, the TSA issued (and has since, reissued) a safety directive to pipeline utility firms that, partially, requested them to higher perceive their DNS site visitors.
In fact, pipelines usually are not the one targets of such assaults, which means we’d like cheap methodologies for figuring out and investigating probably malicious domains. On this article, we stroll you thru the way you may programmatically achieve visibility into and examine unusual DNS requests utilizing Cisco Umbrella APIs.
Preliminary developer setup
To create this automation, we assume you could have an energetic Cisco Umbrella account with API entry, Python3, and an built-in developer surroundings (IDE) that helps Python.
If you happen to’re not but an Umbrella person, otherwise you’d merely wish to create a proof-of-concept (POC) round this, you possibly can leverage the always-on Umbrella Safe Web Gateway sandbox by means of Cisco DevNet.
Defining what site visitors is “unusual”
The day earlier than writing this text, Cisco Umbrella processed over 800 billion DNS requests. Because of this persistently huge quantity of site visitors processing and evaluation, Umbrella maintains an updated “High 1-Million Domains” record as a CSV. This info establishes a baseline of what site visitors is widespread.
We are able to decide what site visitors coming out of your Umbrella community is rare by evaluating it to this High 1-Million Domains record.
To do that, we make an API name utilizing the Umbrella Reviews API to retrieve the High Locations seen by your Umbrella community previously week. The decision returns an inventory of domains from most to least widespread, one per row, as a CSV, that we are able to clear to take away the rank order and non-domains. (For instance, take away the 8 on this row: 8,www.google.com, and take away IP handle locations as a result of they received’t match an Umbrella High 1-Million area)
We are able to then write logic that compares the domains seen by your community to Umbrella’s High 1-Million and provides any of your domains that aren’t on that record to a brand new CSV.
Pattern Code
We’ve written a pattern Python script that can assist you obtain this utilizing your personal DNS site visitors! That script, together with directions for working it, may be discovered right here.
Investigating unusual domains with Umbrella APIs
When you’ve recognized which domains seen by your community are thought of much less widespread, you could select to additional examine some—or all—of them utilizing Umbrella Examine.
In case you have an Umbrella DNS Safety Benefit or Safe Web Gateway (SIG) package deal, within the Umbrella dashboard, you possibly can navigate to Examine > Good Search and seek for the area you’d like to research. You’ll see outcomes that present info trying one thing like what you see beneath for examplemalwaredomain.com:
Determine 1: The start of Umbrella Examine outcomes for examplemalwaredomain.com
The outcomes first present you each the content material and safety classes for the area, offered by Cisco Talos. We are able to see that this area is assessed as malware and is already on a Malware Block Listing; although, if we needed to, we may discover extra info on this area throughout Talos, Google, or VirusTotal (prime proper).
Determine 2: The danger rating and safety indicators for examplemalwaredomain.com
Scrolling down the outcomes, we subsequent see the danger rating assigned to this area and the safety indicators that went into calculating that rating. On this case, the area is assessed as Excessive Danger, with extra info on the safety indicators used right here.
After viewing primary info on the area, resembling when it was created and from what nation it originates, in addition to related observables like IP addresses, identify servers, and information, you’ll discover WHOIS report info on the area (see beneath). You’ll discover that Umbrella Examine lets you additional examine the related electronic mail handle and nameservers.
Determine 3: WHOIS report information for examplemalwaredomain.com
Lastly, we are able to view a worldwide map exhibiting the place DNS requests to examplemalwaredomain.com. Within the instance map beneath, over 95% of DNS requests to this area originate from the USA.
Determine 4: World requestor distribution map for examplemalwaredomain.com
These Umbrella Examine outcomes are additionally out there as a part of the Umbrella Examine API, which means that the investigation of those unusual domains will also be achieved programmatically.
Extra alternatives for automation
What are the chances for constructing upon the automation we’ve offered within the pattern code?
- Examine – including logic that for every unusual area, an API name is made to the Umbrella Examine endpoint to retrieve information and any risk intel
- Ticketing – you possibly can combine a ticketing system, like Jira, by leveraging its API to create and assign a ticket for every unusual area
- Coverage Adjustments – use the Umbrella Locations Listing API to permit or block a number of of the unusual domains
- Reporting – export the unusual domains, and maybe information on them from Umbrella Examine, right into a extra palatable format like PDF. Area information is also enhanced by intel from different safety merchandise, by viewing related units and their relationships with the area utilizing JupiterOne, and/or utilized in a visualization.
- Orchestration – you possibly can orchestration an automation workflow with a number of steps (not all of these steps want be automated) utilizing Cisco XDR. The workflow may embrace all steps your group requires for investigation and incident response.
- Communication – somewhat than save the ensuing CSV of domains domestically, you could select to mechanically electronic mail the outcomes to events or publish the outcomes to a messaging platform like WebEx.
Share: