chainguard-dev / chainguard-dev/osquery-defense-kit
Exclude DNS over TLS from unexepcted talkers
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 643
- Forks
- 51
- PR merge metrics
- No merged PRs in 30d
Description
remote port 853 is expected from systemd-resolved where using DNS over TLS.
{"name":"pack_detection_1-unexpected-talkers-linux","hostIdentifier":"fedora","calendarTime":"Mon Jun 30 21:33:54 2025 UTC","unixTime":1751319234,"epoch":0,"counter":2,"numerics":false,"columns":{"cgroup_path":"/system.slice/systemd-resolved.service","child_cmd":"/usr/lib/systemd/systemd-resolved","cwd":"/","euid":"990","exception_key":"853,6,500,systemd-resolved,0u,0g,systemd-resolve","local_address":"192.168.86.69","local_port":"54556","name":"systemd-resolve","parent_cmd":"/usr/lib/systemd/systemd --switched-root --system --deserialize=49 rhgb","parent_path":"/usr/lib/systemd/systemd","parent_pid":"1","path":"/usr/lib/systemd/systemd-resolved","remote_address":"1.1.1.1","remote_port":"853","sha256":"cbd9c5369244db02ebb20200e57a8455cfc07d5ff966da9fed6811b57ed02561","state":"ESTABLISHED"},"action":"removed"}
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the pack_detection_1-unexpected-talkers-linux query and inspect how systemd-resolved connections are classified. Update the unexpected-talkers logic so DNS over TLS connections using remote port 853 are excluded, then verify that the provided systemd-resolved example is no longer reported.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100