User Guide

Synapse-PSL User Guide

Synapse-PSL adds new Storm commands for ingesting the Public Suffix List.

Examples

Set the tag to apply to nodes

When ingesting the Public Suffix List, a tag will be applied to the inet:fqdn nodes with the value of the tag set to the time the command was run. The default tag is rep.psl.suffix, which can be modified with the psl.setup.tag command:

> psl.setup.tag my.psl.tag
Setting PSL tag to my.psl.tag.

Ingest the Public Suffix List

Note that normally this command should be allowed to run to completion, the example output is limited for demonstration purposes.

> psl.ingest --yield | limit 3
inet:fqdn=ac
        .created = 2024/11/19 21:26:15.759
        :host = ac
        :issuffix = true
        :iszone = false
        #rep.psl.suffix = (2024/11/19 21:26:15.734, 2024/11/19 21:26:15.735)
inet:fqdn=com.ac
        .created = 2024/11/19 21:26:15.782
        :domain = ac
        :host = com
        :issuffix = true
        :iszone = true
        :zone = com.ac
        #rep.psl.suffix = (2024/11/19 21:26:15.734, 2024/11/19 21:26:15.735)
inet:fqdn=edu.ac
        .created = 2024/11/19 21:26:15.803
        :domain = ac
        :host = edu
        :issuffix = true
        :iszone = true
        :zone = edu.ac
        #rep.psl.suffix = (2024/11/19 21:26:15.734, 2024/11/19 21:26:15.735)

Create a cron job to ingest the PSL daily

> cron.add --name psl.ingest --hour 5 { psl.ingest }
Created cron job: 7aa8c3ab01aa3e605776784c10f4e5b6

Use of meta:source nodes

Synapse-PSL uses a meta:source node and -(seen)> light weight edges to track nodes observed from the PSL API.

> meta:source=0cf6ba40daf9e36c7b7efb9d8e11ae50
meta:source=0cf6ba40daf9e36c7b7efb9d8e11ae50
        .created = 2024/11/19 21:26:15.726
        :name = public suffix list

Storm can be used to filter nodes to include/exclude nodes which have been observed by Synapse-PSL. The following example shows how to filter the results of a query to include only results observed by Synapse-PSL:

> inet:fqdn=edu.ac +{ <(seen)- meta:source=0cf6ba40daf9e36c7b7efb9d8e11ae50 }
inet:fqdn=edu.ac
        .created = 2024/11/19 21:26:15.803
        :domain = ac
        :host = edu
        :issuffix = true
        :iszone = true
        :zone = edu.ac
        #rep.psl.suffix = (2024/11/19 21:26:15.734, 2024/11/19 21:26:15.735)