Is it feasible to enrich events with say, DNS CAA record details as it flows through stream?
Are you saying you want to use the DNS lookup function to enrich?
Or something else?
Looks like we need to add the CAA resource type to the DNS Lookup function, but you should be able to get the result with the `ANY` type and then use an eval.
<@U02UFGDA7N1> for your attention ^^
Yah, CAA and a few recent bits of DNS seem to get skipped a lot
Maybe make record type a free text field?
Like the Redis function
Might be some differences in the functionality behind the scenes, but good idea
Yeah, I tried to hack the JSON and insert CAA, but it is too strict and doesn't accept the value :slightly_smiling_face:
would the DNS Lookup function returned information be dependent on host OS?
I strongly doubt that
Even Windows usually manages to resolve DNS
Using the function via Edge that's collecting from a Windows 10 device. But I'm not seeing any CAA information
Do you have access to the box?
I just learned that neither nslookup nor Powershell can handle CAA records oO
yah, hence my question
I can't believe this. Found a bug report for PHP from 2018 where someone ran into the same issue. Seems the Windows API just lacks this function. What a mess...
Gotta love Windows.
Maybe will see it in Windows 12
eventually this will shift to a Linux box, maybe I'll just speed that up heh
Ha, I asked ChatGPT and exactly as expected it lied to me and told me it works with nslookup. That mofo.
I keep working on teaching lies to ChatGPT
As if it needs help with making shit up
I moved it to linux and got 1 or two CAA records enriched on my events, of course the event im using to test gets no dns enrichment heh
Hey Leif, I captured this in a feature request, the Integ team will be tracking using Cribl-17915