# Passive DNS IOC hunting script **URL:** \ **Category:** Zeek\ **Created:** [February 18, 2017, 12:57pm UTC](https://community.zeek.org/t/passive-dns-ioc-hunting-script/4678 "2017-02-18T12:57:33Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Obdnanr\_smith](https://avatars.discourse-cdn.com/v4/letter/o/9e8a1a/32.png) [@Obdnanr\_smith](https://community.zeek.org/u/Obdnanr_smith)\ **Post date:** [February 18, 2017, 12:57pm UTC](https://community.zeek.org/t/passive-dns-ioc-hunting-script/4678/1 "2017-02-18T12:57:33Z")
I’ve created a script that uses Justin Azoff’s bro-pdns-go-rewrite script to search the passive DNS database for IOC hits from a text file hosted on a webserver; we’re using CRITS. You can cron both scripts, but I can’t figure out how to get it to send one email alert per run of the script, so don’t set it to every 5 minutes. You may need to touch some of the csvs if it complains they aren’t there. You’ll need to enter the full path name on the sortuniqe.sh script also. I can’t find Justin’s Github for the go-rewrite, so maybe he can chime in with those details. [https://github.com/obdnanr/bro-pdns-ioc-search-alert](https://github.com/obdnanr/bro-pdns-ioc-search-alert) Thanks ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [February 18, 2017, 3:09pm UTC](https://community.zeek.org/t/passive-dns-ioc-hunting-script/4678/2 "2017-02-18T15:09:09Z")
It's in a branch: [https://github.com/JustinAzoff/bro-pdns/tree/go-rewrite](https://github.com/JustinAzoff/bro-pdns/tree/go-rewrite) ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/passive-dns-ioc-hunting-script/4678/3 "2022-05-06T15:44:39Z")
Closed on May 6, 2022, 3:44pm UTC