{"action":"created","issue":{"url":"https://api.github.com/repos/certtools/intelmq/issues/373","labels_url":"https://api.github.com/repos/certtools/intelmq/issues/373/labels{/name}","comments_url":"https://api.github.com/repos/certtools/intelmq/issues/373/comments","events_url":"https://api.github.com/repos/certtools/intelmq/issues/373/events","html_url":"https://github.com/certtools/intelmq/issues/373","id":112797942,"number":373,"title":"BOT: DNS lookup","user":{"login":"robcza","id":11228982,"avatar_url":"https://avatars.githubusercontent.com/u/11228982?v=3","gravatar_id":"","url":"https://api.github.com/users/robcza","html_url":"https://github.com/robcza","followers_url":"https://api.github.com/users/robcza/followers","following_url":"https://api.github.com/users/robcza/following{/other_user}","gists_url":"https://api.github.com/users/robcza/gists{/gist_id}","starred_url":"https://api.github.com/users/robcza/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robcza/subscriptions","organizations_url":"https://api.github.com/users/robcza/orgs","repos_url":"https://api.github.com/users/robcza/repos","events_url":"https://api.github.com/users/robcza/events{/privacy}","received_events_url":"https://api.github.com/users/robcza/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-10-22T13:03:48Z","updated_at":"2015-10-22T13:39:15Z","closed_at":null,"body":"We are considering a bot to do a DNS lookup for events, where only fqdn is included. Except the performance issues that will be the same as in the case of reverse_dns expert bot, we have encountered another issue. Forward lookup could return more than one IP address for the domain, what to do with the result?\r\n- split the event in more events and fill the source.ip with the results of the dns lookup\r\n- add new attribute for the results of the dns lookup\r\n\r\nWhat do you suggest?"},"comment":{"url":"https://api.github.com/repos/certtools/intelmq/issues/comments/150226175","html_url":"https://github.com/certtools/intelmq/issues/373#issuecomment-150226175","issue_url":"https://api.github.com/repos/certtools/intelmq/issues/373","id":150226175,"user":{"login":"robcza","id":11228982,"avatar_url":"https://avatars.githubusercontent.com/u/11228982?v=3","gravatar_id":"","url":"https://api.github.com/users/robcza","html_url":"https://github.com/robcza","followers_url":"https://api.github.com/users/robcza/followers","following_url":"https://api.github.com/users/robcza/following{/other_user}","gists_url":"https://api.github.com/users/robcza/gists{/gist_id}","starred_url":"https://api.github.com/users/robcza/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robcza/subscriptions","organizations_url":"https://api.github.com/users/robcza/orgs","repos_url":"https://api.github.com/users/robcza/repos","events_url":"https://api.github.com/users/robcza/events{/privacy}","received_events_url":"https://api.github.com/users/robcza/received_events","type":"User","site_admin":false},"created_at":"2015-10-22T13:39:14Z","updated_at":"2015-10-22T13:39:14Z","body":"Array is an obvious solution, and although I'm not a fan of adding new attributes, I don't think we should split an event into more. The logic behind the event is \"this fqdn is bad\" and splitting the event would be misleading on the output. My opinion is - we should add new array attribute.\r\n\r\nI do not have any particular event example, but any domain with more IPs will do, sorry google:\r\n```\r\nNon-authoritative answer:\r\nName:\tgoogle.com\r\nAddress: 173.194.123.72\r\nName:\tgoogle.com\r\nAddress: 173.194.123.68\r\nName:\tgoogle.com\r\nAddress: 173.194.123.73\r\nName:\tgoogle.com\r\nAddress: 173.194.123.67\r\nName:\tgoogle.com\r\nAddress: 173.194.123.69\r\nName:\tgoogle.com\r\nAddress: 173.194.123.65\r\nName:\tgoogle.com\r\nAddress: 173.194.123.70\r\nName:\tgoogle.com\r\nAddress: 173.194.123.66\r\nName:\tgoogle.com\r\nAddress: 173.194.123.71\r\nName:\tgoogle.com\r\nAddress: 173.194.123.78\r\nName:\tgoogle.com\r\nAddress: 173.194.123.64\r\n```"}}