diff --git a/webapp/src/formatters.ts b/webapp/src/formatters.ts index 997fcc80..b9ef9b87 100644 --- a/webapp/src/formatters.ts +++ b/webapp/src/formatters.ts @@ -51,12 +51,15 @@ export function formatEventDescription(event: Event): string { case "dns": { const dns = event._source.dns!; let parts = [dns.type.toUpperCase()]; - if (dns.rrtype) { - parts.push(dns.rrtype.toUpperCase()); - } - if (dns.rrname) { + + if (dns.queries[0]) { + parts.push(dns.queries[0].rrtype); + parts.push(dns.queries[0].rrname); + } else if (dns.rrname) { + parts.push(dns.rrtype); parts.push(dns.rrname); } + if (dns.rcode && dns.rcode !== "NOERROR") { parts.push(...["-", dns.rcode]); } diff --git a/webapp/src/types.ts b/webapp/src/types.ts index 4fd05377..55491bfd 100644 --- a/webapp/src/types.ts +++ b/webapp/src/types.ts @@ -163,6 +163,11 @@ export interface EveDns { rrname: string; }[]; + queries: { + rrname: string; + rrtype: string; + }[]; + answers?: { rdata: string; rrname: string;