analyzer: Add CleanBrowsing Detector. Closes #1784#3254
analyzer: Add CleanBrowsing Detector. Closes #1784#3254mlodic merged 5 commits intointelowlproject:developfrom
Conversation
|
Two questions I have before this can be merged:
What JSON output should I put there, since the cleanbrowsing api responds with binary data
Is there a datamodel required? I tried to do exactly what the Cloudflare Malicious detector analyzer does and couldnt find any data model for that, but I just wanted to confirm |
3c1977a to
a4bc2ab
Compare
|
Doc update: intelowlproject/docs#49 |
There was a problem hiding this comment.
Pull request overview
This pull request adds a new CleanBrowsing DNS malicious detector analyzer that checks if domains are reported as malicious by querying CleanBrowsing's DNS-over-HTTPS security filter endpoint. The implementation follows the established pattern of other DNS malicious detectors in the codebase (e.g., Cloudflare, DNS4EU) and uses POST requests to send DNS queries in wire format.
Changes:
- Added CleanBrowsingMaliciousDetector analyzer that detects blocked domains by checking for CleanBrowsing-specific SOA records in DNS authority sections
- Created comprehensive unit tests with proper DNS response mocking
- Added analyzer configuration migration and playbook integration for FREE_TO_USE_ANALYZERS and Dns playbooks
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| api_app/analyzers_manager/observable_analyzers/dns/dns_malicious_detectors/cleanbrowsing_malicious_detector.py | Main analyzer implementation using DoH POST method to query CleanBrowsing security filter |
| tests/api_app/analyzers_manager/unit_tests/observable_analyzers/test_cleanbrowsing_malicious_detector.py | Unit test with mocked DNS response including NXDOMAIN and SOA records |
| api_app/analyzers_manager/migrations/0175_analyzer_config_cleanbrowsing_malicious_detector.py | Django migration to add analyzer configuration to database |
| api_app/playbooks_manager/migrations/0062_add_cleanbrowsing_to_free_to_use.py | Django migration to add analyzer to FREE_TO_USE_ANALYZERS and Dns playbooks |
| tests/api_app/playbooks_manager/test_views.py | Updated playbook test to include new analyzer in expected list |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
...manager/observable_analyzers/dns/dns_malicious_detectors/cleanbrowsing_malicious_detector.py
Outdated
Show resolved
Hide resolved
...manager/observable_analyzers/dns/dns_malicious_detectors/cleanbrowsing_malicious_detector.py
Outdated
Show resolved
Hide resolved
...manager/observable_analyzers/dns/dns_malicious_detectors/cleanbrowsing_malicious_detector.py
Outdated
Show resolved
Hide resolved
...manager/observable_analyzers/dns/dns_malicious_detectors/cleanbrowsing_malicious_detector.py
Outdated
Show resolved
Hide resolved
api_app/analyzers_manager/migrations/0175_analyzer_config_cleanbrowsing_malicious_detector.py
Show resolved
Hide resolved
…us_detectors/cleanbrowsing_malicious_detector.py Co-authored-by: Copilot <[email protected]>
…us_detectors/cleanbrowsing_malicious_detector.py Co-authored-by: Copilot <[email protected]>
api_app/analyzers_manager/migrations/0175_analyzer_config_cleanbrowsing_malicious_detector.py
Outdated
Show resolved
Hide resolved
api_app/analyzers_manager/migrations/0175_analyzer_config_cleanbrowsing_malicious_detector.py
Outdated
Show resolved
Hide resolved
...manager/observable_analyzers/dns/dns_malicious_detectors/cleanbrowsing_malicious_detector.py
Outdated
Show resolved
Hide resolved
...manager/observable_analyzers/dns/dns_malicious_detectors/cleanbrowsing_malicious_detector.py
Outdated
Show resolved
Hide resolved
api_app/playbooks_manager/migrations/0062_add_cleanbrowsing_to_free_to_use.py
Show resolved
Hide resolved
|
about your questions, you are fine, just please re-run the analyzer after the requested changes and show the visualizer result |
…rove error handling
… cleanbrowsing_dns_detector
|
Is there anything else? Can I start working on other issues? |
|
yep sure! |
Description
Add CleanBrowsing DNS Detector
Closes #1784
Type of change
Analyzer Output
Checklist
developdumpplugincommand and added it in the project as a data migration. ("How to share a plugin with the community")FREE_TO_USE_ANALYZERSplaybook by following this guide.urlthat contains this information. This is required for Health Checks (HEAD HTTP requests).get_mocker_response()method of the unittest class. This serves us to provide a valid sample for testing.DataModelfor the new analyzer following the documentation# This file is a part of IntelOwl https://github.com/intelowlproject/IntelOwl # See the file 'LICENSE' for copying permission.Black,Flake,Isort) gave 0 errors. If you have correctly installed pre-commit, it does these checks and adjustments on your behalf.^ i'll be doing this (again)
testsfolder). All the tests (new and old ones) gave 0 errors.DeepSource,Django Doctorsor other third-party linters have triggered any alerts during the CI checks, I have solved those alerts.