An IIHT Company

DNS serves as the Internet’s control plane, offering an unprecedented level of insight into applications, devices, and the data transferred in and out of a network. Approximately 80% of malware relies on DNS for communication with Command & Control, facilitating DNS data exfiltration/infiltration, and executing phishing attacks through deceptive domain names. Response Policy Zones (RPZ) or DNS Firewall is a feature that empowers us to apply security policies to DNS. It’s worth noting that most commercial DNS Firewall providers do not permit users to generate their own data feeds.

ioc2rpz functions as a DNS server designed to automatically generate, manage, and disseminate DNS Firewall data feeds from various sources, including local files and databases, as well as remote sources like HTTP, FTP, and RPZ. This capability simplifies integration with Threat Intelligence providers and Threat Intelligence Platforms. The generated feeds can be distributed to a wide range of open-source and commercial DNS servers that support DNS Firewall/RPZ, such as ISC BIND, PowerDNS, Infoblox, BlueCat, Efficient IP, and more. Utilizing ioc2rpz allows you to create custom feeds and actions, preemptively preventing unwanted communications from occurring.