# vector array of string used as a pattern for matching **URL:** \ **Category:** Zeek\ **Created:** [February 27, 2014, 7:23pm UTC](https://community.zeek.org/t/vector-array-of-string-used-as-a-pattern-for-matching/3019 "2014-02-27T19:23:25Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Kellogg\_Brian\_GS\_IT](https://avatars.discourse-cdn.com/v4/letter/k/f05b48/32.png) [@Kellogg\_Brian\_GS\_IT](https://community.zeek.org/u/Kellogg_Brian_GS_IT)\ **Post date:** [February 27, 2014, 7:23pm UTC](https://community.zeek.org/t/vector-array-of-string-used-as-a-pattern-for-matching/3019/1 "2014-02-27T19:23:25Z")
I’m trying to create an array of domain names that I want to use as a pattern to search on. I know the below is wrong; just looking for someone to educate me on how to do this in a Bro script if it can be done. thanks global ignoreDomains: vector of string = vector(“[webex.com](http://webex.com)”, “[pwc.com](http://pwc.com)”, “[messagelabs.com](http://messagelabs.com)”,“[akamaitechnologies.com](http://akamaitechnologies.com)”); when (local dst = lookup\_addr(c$id$resp\_h)) { if (/ignoreDomains$/ in dst) return; } Thank you, **Brian Kellogg** Security Analyst; IT Governance, Risk, and Compliance 500 Paul Clark Drive, Olean, NY 14760 T: (716) 375-3186 | F: (716) 375-3557 [www.dresser-rand.com](http://www.dresser-rand.com/) NYSE: DRC ![Description: Description: Description: Description: Description: Description: d-r_wordraster3R-hi](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/5b8a993112174beae3a1ed5790be0e9150d2801d.jpeg) Bringing energy and the environment into harmony® **IMPORTANT NOTICE:** **This email may be confidential, may be legally privileged, and is for the intended recipient only. Unauthorized access, disclosure, copying, distribution, or reliance on any of it by anyone else is prohibited and may be a criminal offense. Please delete if obtained in error and email confirmation to the sender.** ---
**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\ **Post date:** [February 27, 2014, 7:56pm UTC](https://community.zeek.org/t/vector-array-of-string-used-as-a-pattern-for-matching/3019/2 "2014-02-27T19:56:27Z")
You could use a set of patterns. foo: set[pattern] = YourPatterns for (each in foo) { if (each in DomainInQuestion) DoSomething } -AK ![image001.jpg](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/5b8a993112174beae3a1ed5790be0e9150d2801d.jpeg) ---
**Author:** ![Kellogg\_Brian\_GS\_IT](https://avatars.discourse-cdn.com/v4/letter/k/f05b48/32.png) [@Kellogg\_Brian\_GS\_IT](https://community.zeek.org/u/Kellogg_Brian_GS_IT)\ **Post date:** [February 27, 2014, 7:58pm UTC](https://community.zeek.org/t/vector-array-of-string-used-as-a-pattern-for-matching/3019/3 "2014-02-27T19:58:35Z")
Thanks, I thought of that as well. I was trying to not use a loop if at all possible. Thanks, Brian ![image001.jpg](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/5b8a993112174beae3a1ed5790be0e9150d2801d.jpeg) ---
**Author:** ![Jim\_Mellander](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@Jim\_Mellander](https://community.zeek.org/u/Jim_Mellander)\ **Post date:** [February 27, 2014, 8:28pm UTC](https://community.zeek.org/t/vector-array-of-string-used-as-a-pattern-for-matching/3019/4 "2014-02-27T20:28:31Z")
I wrote some fairly elaborate code (called Stomper) a number of years ago that performed URL/domain matching on a blacklist, and killed the connections in realtime, probably could be adapted to your use case. Aside from the other actions, the domain matching is done by successively splitting the domain into smaller parts & check for set membership An example - given a domain [www.badguy.com](http://www.badguy.com) we would check: [www.badguy.com](http://www.badguy.com) [badguy.com](http://badguy.com) .com for membership in the set, and act on it accordingly - of course, unless you’re interested in tracking by TLD you wouldn’t go all the way down to .com, in this example. If you’re interested in the code, contact me offline ![image001.jpg](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/5b8a993112174beae3a1ed5790be0e9150d2801d.jpeg) ---
**Author:** ![Aaron\_Gee-Clough](https://avatars.discourse-cdn.com/v4/letter/a/a3d4f5/32.png) [@Aaron\_Gee-Clough](https://community.zeek.org/u/Aaron_Gee-Clough)\ **Post date:** [February 28, 2014, 2:47pm UTC](https://community.zeek.org/t/vector-array-of-string-used-as-a-pattern-for-matching/3019/5 "2014-02-28T14:47:14Z")
Wouldn't this be a good use case for a Bloom filter? [http://www.bro.org/sphinx/scripts/base/bif/bloom-filter.bif.html](http://www.bro.org/sphinx/scripts/base/bif/bloom-filter.bif.html) aaron ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [February 28, 2014, 3:12pm UTC](https://community.zeek.org/t/vector-array-of-string-used-as-a-pattern-for-matching/3019/6 "2014-02-28T15:12:23Z")
# Create a set of domain suffixes. global ignore\_domains = set(".webex.com", ".pwc.com", ".messagelabs.com", ".akamaitechnologies.com"); # Create an empty pattern where we're going to automatically create. global my\_domain\_suffixes = /MATCH\_NOTHING/; # There is bug with setting blank patterns at the moment. event bro\_init() &priority=10   {   # Create the my\_domain\_suffixes pattern by auto constructing it from the ignore\_domains set.   my\_domain\_suffixes = set\_to\_regex(ignore\_domains, "(^\\.?|\\.)(~~)$");   } # I'll give an example event like you want. event whatever(c: connection)   {   when (local name = lookup\_addr(c$id$resp\_h))     {     if (my\_domain\_suffixes in name)       return;     }   } One thing to keep in mind with this script is the amount of DNS traffic you could easily cause if you handle an event that fires a lot (like the connection\_established event). You may want to do some name caching or restrictions for when the look ups are done. We are also getting some evidence that overusing when statements is causing trouble for a few people. Please when you are writing scripts, put them into a namespace (with "module MySpecialModule;" at the beginning of your script) to help us avoid stomping on identifier names that you are using. Thanks,   .Seth ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [February 28, 2014, 3:37pm UTC](https://community.zeek.org/t/vector-array-of-string-used-as-a-pattern-for-matching/3019/7 "2014-02-28T15:37:07Z")
> the domain matching is done by successively splitting the domain into smaller parts & check for set membership This has a lot of overhead in Bro at the moment due to the amount of string manipulation. I have an example module of a faster way to do this that doesn't involve any string manipulation.   [https://github.com/sethhall/bro-junk-drawer/tree/master/domain-tld](https://github.com/sethhall/bro-junk-drawer/tree/master/domain-tld) It includes Mozilla's list of "effective TLDs". Things like co.uk are counted as TLDs. > @load domain-tld > DomainTLD::effective\_tld("www.google.co.uk");   =\> co.uk > DomainTLD::effective\_tld("www.google.com");   =\> com > DomainTLD::effective\_domain("whatever.www.blah.google.co.uk");   =\> google.co.uk > DomainTLD::effective\_domain("whatever.www.blah.google.com");   =\> google.com   .Seth ---
**Author:** ![Kellogg\_Brian\_GS\_IT](https://avatars.discourse-cdn.com/v4/letter/k/f05b48/32.png) [@Kellogg\_Brian\_GS\_IT](https://community.zeek.org/u/Kellogg_Brian_GS_IT)\ **Post date:** [February 28, 2014, 3:46pm UTC](https://community.zeek.org/t/vector-array-of-string-used-as-a-pattern-for-matching/3019/8 "2014-02-28T15:46:03Z")
Thank you! This is for a script that alerts on large outgoing Tx's. So the domain lookups are not going to be that frequent; at least they better not be. Hopefully I'll get some time next week to work this solution in. Wish I had more time to spend on Bro. It is an incredible and invaluable tool for any NSM solution. Thank you, Brian Kellogg ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/vector-array-of-string-used-as-a-pattern-for-matching/3019/9 "2022-05-06T15:41:37Z")