Overview
ioc2rpz: Where Threat Intelligence Meets DNS
DNS is the control plane of the Internet with unprecedented detailed views on applications, devices and even transferred data going in and out of a network. 80% of malware uses DNS to communicate with Command & Control for DNS data exfiltration/infiltration and phishing attacks using lookalike domains. Response Policy Zones or DNS Firewall is a feature which allows us to apply security policies on DNS. Commercial DNS Firewall feeds providers usually do not allow users to generate their own feeds.
ioc2rpz is a DNS server which automatically creates, maintains and distributes DNS Firewall feeds from various local (files, DB) and remote (http, ftp, rpz) sources. This enables easy integrations with Threat Intel providers and Threat Intelligence Platforms. The feeds can be distributed to any open source and commercial DNS servers which support DNS Firewall/RPZ (Response Policy Zones), e.g. ISC BIND, PowerDNS, Infoblox, BlueCat, Efficient IP etc. With ioc2rpz you can create your own feeds, actions and prevent undesired communications before they happen.
ioc2rpz technology was presented at BlackHat Arsenal 2019/2020 and DefCon Demo Labs 26/27
Highlights
- DNS Firewall Feeds From Any Source
Details
Typical total price
$0.282/hour
Pricing
Free trial
Instance type | Product cost/hour | EC2 cost/hour | Total/hour |
|---|---|---|---|
r6g.medium | $0.02 | $0.05 | $0.07 |
r6g.large | $0.04 | $0.101 | $0.141 |
r6g.xlarge Recommended | $0.08 | $0.202 | $0.282 |
r6g.2xlarge | $0.16 | $0.403 | $0.563 |
r6g.4xlarge | $0.32 | $0.806 | $1.126 |
r6gd.medium | $0.02 | $0.058 | $0.078 |
r6gd.large | $0.04 | $0.115 | $0.155 |
r6gd.xlarge | $0.08 | $0.23 | $0.31 |
r6gd.2xlarge | $0.16 | $0.461 | $0.621 |
r6gd.4xlarge | $0.32 | $0.922 | $1.242 |
Additional AWS infrastructure costs
Type | Cost |
|---|---|
EBS General Purpose SSD (gp2) volumes | $0.10/per GB/month of provisioned storage |
Vendor refund policy
no refunds
Legal
Vendor terms and conditions
Content disclaimer
Delivery details
64-bit (Arm) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
initial release on AWS Ubuntu ARM64
Additional details
Usage instructions
The image contains ioc2rpz and ioc2rpz.gui. ioc2rpz keeps all data in RAM and it is recommended to allocate 1Gb RAM per 500k rules (250k fqdn/domain IoCs). ioc2rpz doesn't monitor available RAM so you should control the load.
Before deployment:
- select image depending on your maximum feeds size (1Gb RAM per 500k rules);
- enable HTTPs (443/tcp) and DNS (53/udp, 53/tcp, 853/tcp) access to the instance.
After deployment (no configuration exists):
- use your preferred browser to login to the web interface and create a new user;
- login to the web interface with created credentials;
- server's public IP is set to 127.0.0.1, update it to an IPv4-address which will be used to distribute DNS Firewall feeds. It can be private or public and will be used in the interface to generate a test DIG command. By default ioc2rpz is listening on all interfaces;
- you can test service by pulling already provisioned DNS Firewall feed with dig command.
Resources
Vendor resources
Support
Vendor support
for issues with your instances - email us, for bugs - open an issue on github aws_support@ioc2rpz.net ,
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
