Whalebone Immunity

https://docs.whalebone.io/en/immunity/
Admin
Whalebone Immunity is a DNS security solution that filters DNS traffic, blocks cyber threats, and...
Tokens:53,137
Snippets:426
Trust Score:9.5
Update:1 month ago
Show doc for...
Tokens:
Raw
### Pairing Token Example (GUI Installation)

Source: https://docs.whalebone.io/en/immunity/hos_installation.html

Example pairing token to enter during GUI installation on Windows. The token is provided on the Portal.

```text
aG9zLmFwcDovL2F1dGg/dG9rZW49MTIzNDU2NzgtMTIzNC0xMjM0LTEyMzQtMTIzNDU2Nzg5MDEyJnJlZ2lvbj1ldS0wMQ==
```

--------------------------------

### content.log example

Source: https://docs.whalebone.io/en/immunity/syslog_integration.html

Example JSON log entry from content.log showing a blocked DNS request with fields like timestamp, action, domain, and matrix.

```json
{
    "timestamp": "2025/06/12 06:44:27.049917",
    "action": "block",
    "server_ip": "192.168.0.10",
    "client_ip": "192.168.10.41",
    "domain": "whalebone.com",
    "ioc": "whalebone.com",
    "identity": "wb-default-policy",
    "mobile_client_id": "",
    "device_id": "",
    "content_types": [
        "social-networks"
     ],
    "legal_types": [],
    "app_blocked_intersect": [],
    "scheduled_filter": [],
    "scheduled_internet": "false",
    "policy_name": "",
    "policy_group_id": "",
    "policy_tags": "",
    "pin": "0",
    "region": "eu-01",
    "segment_id": "",
    "brand_id": "",
    "subscription_id": "",
    "answer": "SINKHOLE_IP",
    "sinkhole_type": "1",
    "port": "56121",
    "type": "A",
    "rcode": "0",
    "matrix": {
        "accuracy_audit": "false",
        "accuracy_block": "false",
        "content": "true",
        "advertisement": "false",
        "legal": "false",
        "whitelist": "false",
        "blacklist": "false",
        "bypass": "false",
        "apps_blocked": "false",
        "apps_allowed": "false"
    }
}
```

--------------------------------

### create action output

Source: https://docs.whalebone.io/en/immunity/resolver_agent.html

Example output after running the create action.

```json
{'resolver': {'status': 'success'}
```

--------------------------------

### Unattended Installation Command (Windows)

Source: https://docs.whalebone.io/en/immunity/hos_installation.html

Command to silently install Whalebone Home Office Security on Windows 64-bit. Replace TOKEN and REGION with values from the Portal. Use with your preferred MDM.

```bash
msiexec /i "Whalebone.Home.Office.Security.Installer.msi" TOKEN="12345678-1234-1234-1234-123456789012" REGION="eu-01"
```

--------------------------------

### stop action output

Source: https://docs.whalebone.io/en/immunity/resolver_agent.html

Example output after running the stop action on specified containers.

```json
{
        'resolver': {'status': 'success'},
        'lr-agent': {'status': 'success'},
        'kresman': {'status': 'success'}
}
```

--------------------------------

### passivedns.log JSON example

Source: https://docs.whalebone.io/en/immunity/syslog_integration.html

Example JSON record from passivedns.log showing a DNS query response with fields such as response_time, client, server, query, answer, and res_action.

```json
{
    "response_time": "2025-07-24T06:16:50.140828Z",
    "client": "192.168.10.41",
    "server": "192.168.0.10",
    "class": "IN",
    "type": "A",
    "query_port": 39170,
    "response_port": 53,
    "query": "whalebone.com.",
    "answer": "192.168.0.10",
    "identity": "wb-default-policy",
    "ttl": 1,
    "res_action": "block",
    "rcode": 0,
    "ede_code": -1,
    "protocol": "UDP",
    "region": "eu-01",
    "rtt": 0
}
```

--------------------------------

### whalebone.log JSON example

Source: https://docs.whalebone.io/en/immunity/syslog_integration.html

Example JSON record from whalebone.log showing a blocked DNS query with fields such as timestamp, action, domain, ioc, accuracy, threat_types, and matrix.

```json
{
    "timestamp": "2025/08/18 13:07:20.460737",
    "action": "block",
    "server_ip": "192.168.0.10",
    "client_ip": "192.168.10.41",
    "domain": "spam.test.attacker.online",
    "ioc": "spam.test.attacker.online",
    "identity": "wb-default-policy",
    "mobile_client_id": "",
    "device_id": "",
    "accuracy": "100",
    "threat_types": [
        "spam"
    ],
    "app_blocked_intersect": [],
    "scheduled_internet": "false",
    "policy_name": "",
    "policy_group_id": "",
    "policy_tags": "",
    "pin": "0",
    "region": "eu-01",
    "segment_id": "",
    "brand_id": "",
    "subscription_id": "",
    "answer": "SINKHOLE_IP",
    "sinkhole_type": "8",
    "port": "63559",
    "type": "HTTPS",
    "rcode": "0",
    "matrix": {
        "accuracy_audit": "true",
        "accuracy_block": "true",
        "content": "false",
        "advertisement": "false",
        "legal": "false",
        "whitelist": "false",
        "blacklist": "false",
        "bypass": "false",
        "apps_blocked": "false",
        "apps_allowed": "false"
    }
}
```

--------------------------------

### sysinfo action output

Source: https://docs.whalebone.io/en/immunity/resolver_agent.html

Example JSON output returned by the sysinfo action, providing system status data including hostname, hardware usage, resolver metrics, and container status.

```json
{
   "hostname":"hostname",
   "system":"Linux",
   "platform":"CentOS Linux 7 (Core)",
   "cpu":{
      "count":4,
      "usage":28.6
   },
   "memory":{
      "total":7.6,
      "available":3.9,
      "usage":49.2
   },
   "hdd":{
      "total":50.0,
      "free":14.4,
      "usage":71.1
   },
   "swap":{
      "total":0.0,
      "free":0.0,
      "usage":0
   },
   "resolver":{
      "answer.nxdomain":3284,
      "answer.tc":35,
      "answer.ad":849,
      "answer.100ms":3983,
      "answer.cd":6,
      "answer.1500ms":74,
      "answer.slow":215,
      "answer.rd":224337,
      "answer.1ms":104683,
      "answer.servfail":215,
      "predict.epoch":24,
      "query.dnssec":6,
      "answer.250ms":14941,
      "query.edns":35498,
      "answer.cached":86713,
      "answer.nodata":3622,
      "answer.aa":2362,
      "answer.do":6,
      "answer.edns0":35498,
      "answer.ra":224337,
      "predict.queue":0,
      "answer.total":224337,
      "answer.10ms":35351,
      "answer.noerror":217216,
      "answer.50ms":59766,
      "answer.500ms":4642,
      "answer.1000ms":653,
      "predict.learned":80
   },
   "docker":{
      "Platform":{
         "Name":""
      },
      "Components":[
         {
            "Name":"Engine",
            "Version":"17.12.1-ce",
            "Details":{
               "ApiVersion":"1.35",
               "Arch":"amd64",
               "BuildTime":"2022-02-27T22:17:54.000000000+00:00",
               "Experimental":"false",
               "GitCommit":"88888fc6",
               "GoVersion":"go1.999.999",
               "KernelVersion":"3.22.66-693.21.1.el7.x86_64",
               "MinAPIVersion":"1.99",
               "Os":"linux"
            }
         }
      ],
      "Version":"19.32.1-ce",
      "ApiVersion":"1.98",
      "MinAPIVersion":"1.12",
      "GitCommit":"7390fc6",
      "GoVersion":"go1.9.4",
      "Os":"linux",
      "Arch":"amd64",
      "KernelVersion":"3.10.0-693.21.1.el7.x86_64",
      "BuildTime":"2018-02-27T22:17:54.000000000+00:00"
   },
   "check":{
      "resolve":"ok",
      "port":"ok"
   },
   "containers":{
      "lr-agent":"running",
      "passivedns":"running",
      "resolver":"running",
      "kresman":"running",
      "pcpy":"running",
      "logrotate":"running",
      "logstream":"running"
   },
   "images":{
      "lr-agent":"whalebone/agent:1.1.1",
      "passivedns":"whalebone/passivedns:1.1.1",
      "resolver":"whalebone/kres:1.1.1",
      "kresman":"whalebone/kresman:1.1.1",
      "logrotate":"whalebone/logrotate:1.1.1",
      "logstream":"whalebone/logstream:1.1.1"
   },
   "error_messages":{
   },
   "interfaces":[
      {
         "name":"lo",
         "addresses":[
            "127.0.0.1",
            "::1",
            "00:00:00:00:00:00"
         ]
      },
      {
         "name":"eth0",
         "addresses":[
            "1.1.1.1",
            "::c8",
            "fe80::",
            "00:00:00:00:00:00"
         ]
      },
      {
         "name":"docker0",
         "addresses":[
            "198.1.1.1",
            "00:00:00:00:00:00"
         ]
      }
   ]
}
```

--------------------------------

### Enable Prometheus Metrics with modules.load('http') and net.listen

Source: https://docs.whalebone.io/en/immunity/knot_tips_tricks.html

Enables the HTTP module and exposes the /metrics endpoint on 127.0.0.1:8453 for Prometheus metrics. The pcall is used to handle potential errors.

```lua
modules.load('http')
function startHttp ()
net.listen('127.0.0.1', 8453, { kind = 'webmgmt' })
end
pcall(startHttp)

```

--------------------------------

### Create /certs directory

Source: https://docs.whalebone.io/en/immunity/blocking_pages.html

Create a dedicated directory for certificates. This is the first step in setting up a custom CA for signing blocking pages.

```bash
mkdir /certs

```

```ini
[req]
x509_extensions = v3_ca_extensions
distinguished_name = req_dn
[v3_ca_extensions]
basicConstraints = critical,CA:TRUE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
subjectAltName = @alt_names
[alt_names]
DNS.1 = localhost
[req_dn]
countryName = Country Name (2 letter code)
countryName_default = US
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = New York
localityName = Locality Name (eg, city)
localityName_default = New York City
organizationName = Organization Name (eg, company)
organizationName_default = My Organization
commonName = Common Name (eg, your name or your server's hostname)
commonName_max = 64

```

```bash
openssl ecparam -name prime256v1 -genkey -noout -out /certs/ca.key

```

```bash
openssl req -x509 -new -nodes -key /certs/ca.key -sha256 -days 3650 -out /certs/ca.crt -config /certs/v3_cfg

```

```bash
openssl pkcs12 -export -out /certs/ca.pfx -inkey /certs/ca.key -in /certs/ca.crt -certpbe PBE-SHA1-3DES -keypbe PBE-SHA1-3DES -export -macalg sha1

```

--------------------------------

### Run pending resolver command with ./cli.sh run

Source: https://docs.whalebone.io/en/immunity/resolver_agent.html

Executes the awaiting command. The output shows a success status for the resolver.

```bash
./cli.sh run
```

```text
{'resolver': {'status': 'success'}

```

--------------------------------

### Test URL Output Showing SAML Attributes

Source: https://docs.whalebone.io/en/immunity/sso_troubleshooting.html

Example of a test URL response showing the SAML response with the role key claim 'http://schemas.microsoft.com/ws/2008/06/identity/claims/role' containing 'Domain Admins' and 'Domain Users'. This whole claim name should be used in the Role key field of the SSO configuration.

```json
{
  "aud": "https://login.whalebone.io/sso/12345678-90ab-cdef-1234-567890abcdef/",
  "exp": 1771579797,
  "iat": 1771576197,
  "iss": "https://login.whalebone.io/sso/12345678-90ab-cdef-1234-567890abcdef/",
  "nbf": 1771576197,
  "sub": "user@test.intra",
  "attr": {
    "SessionIndex": [
      "_c3148bb6-4b6a-40e3-b0b3-88ba4b99da32"
    ],
    "http://schemas.microsoft.com/ws/2008/06/identity/claims/role": [
      "Domain Admins",
      "Domain Users"
    ]
  },
  "saml-session": true
}
```

--------------------------------

### Disable QNAME Minimization with policy.FLAGS('NO_MINIMIZE')

Source: https://docs.whalebone.io/en/immunity/knot_tips_tricks.html

Disables QNAME minimization for the specified domain 'domain.com' by adding a policy with the NO_MINIMIZE flag.

```lua
policy.add(policy.suffix(policy.FLAGS('NO_MINIMIZE'), {todname('domain.com')}))

```
Tokens:
Raw