Great build. A next step for this setup could be CDB lists of known malicious domains, so DNS and proxy logs get matched against them with a simple rule. Daily CSV feeds fit that pattern well. The WhoisFreaks feed docs show the record format (whoisfreaks.com/documentation/threat-intelligence…), and there's a free sample to test the rule before wiring in a live feed.
Furqan Ashraf
We are small team, who loves to code.
Great build. A next step for this setup could be CDB lists of known malicious domains, so DNS and proxy logs get matched against them with a simple rule. Daily CSV feeds fit that pattern well. The WhoisFreaks feed docs show the record format (whoisfreaks.com/documentation/threat-intelligence…), and there's a free sample to test the rule before wiring in a live feed.