### Pairing Token Example (GUI Installation)

Source: https://docs.whalebone.io/en/immunity/hos_installation.html

Example pairing token to enter during GUI installation on Windows. The token is provided on the Portal.

```text
aG9zLmFwcDovL2F1dGg/dG9rZW49MTIzNDU2NzgtMTIzNC0xMjM0LTEyMzQtMTIzNDU2Nzg5MDEyJnJlZ2lvbj1ldS0wMQ==
```

--------------------------------

### content.log example

Source: https://docs.whalebone.io/en/immunity/syslog_integration.html

Example JSON log entry from content.log showing a blocked DNS request with fields like timestamp, action, domain, and matrix.

```json
{
    "timestamp": "2025/06/12 06:44:27.049917",
    "action": "block",
    "server_ip": "192.168.0.10",
    "client_ip": "192.168.10.41",
    "domain": "whalebone.com",
    "ioc": "whalebone.com",
    "identity": "wb-default-policy",
    "mobile_client_id": "",
    "device_id": "",
    "content_types": [
        "social-networks"
     ],
    "legal_types": [],
    "app_blocked_intersect": [],
    "scheduled_filter": [],
    "scheduled_internet": "false",
    "policy_name": "",
    "policy_group_id": "",
    "policy_tags": "",
    "pin": "0",
    "region": "eu-01",
    "segment_id": "",
    "brand_id": "",
    "subscription_id": "",
    "answer": "SINKHOLE_IP",
    "sinkhole_type": "1",
    "port": "56121",
    "type": "A",
    "rcode": "0",
    "matrix": {
        "accuracy_audit": "false",
        "accuracy_block": "false",
        "content": "true",
        "advertisement": "false",
        "legal": "false",
        "whitelist": "false",
        "blacklist": "false",
        "bypass": "false",
        "apps_blocked": "false",
        "apps_allowed": "false"
    }
}
```

--------------------------------

### create action output

Source: https://docs.whalebone.io/en/immunity/resolver_agent.html

Example output after running the create action.

```json
{'resolver': {'status': 'success'}
```

--------------------------------

### Unattended Installation Command (Windows)

Source: https://docs.whalebone.io/en/immunity/hos_installation.html

Command to silently install Whalebone Home Office Security on Windows 64-bit. Replace TOKEN and REGION with values from the Portal. Use with your preferred MDM.

```bash
msiexec /i "Whalebone.Home.Office.Security.Installer.msi" TOKEN="12345678-1234-1234-1234-123456789012" REGION="eu-01"
```

--------------------------------

### stop action output

Source: https://docs.whalebone.io/en/immunity/resolver_agent.html

Example output after running the stop action on specified containers.

```json
{
        'resolver': {'status': 'success'},
        'lr-agent': {'status': 'success'},
        'kresman': {'status': 'success'}
}
```

--------------------------------

### passivedns.log JSON example

Source: https://docs.whalebone.io/en/immunity/syslog_integration.html

Example JSON record from passivedns.log showing a DNS query response with fields such as response_time, client, server, query, answer, and res_action.

```json
{
    "response_time": "2025-07-24T06:16:50.140828Z",
    "client": "192.168.10.41",
    "server": "192.168.0.10",
    "class": "IN",
    "type": "A",
    "query_port": 39170,
    "response_port": 53,
    "query": "whalebone.com.",
    "answer": "192.168.0.10",
    "identity": "wb-default-policy",
    "ttl": 1,
    "res_action": "block",
    "rcode": 0,
    "ede_code": -1,
    "protocol": "UDP",
    "region": "eu-01",
    "rtt": 0
}
```

--------------------------------

### whalebone.log JSON example

Source: https://docs.whalebone.io/en/immunity/syslog_integration.html

Example JSON record from whalebone.log showing a blocked DNS query with fields such as timestamp, action, domain, ioc, accuracy, threat_types, and matrix.

```json
{
    "timestamp": "2025/08/18 13:07:20.460737",
    "action": "block",
    "server_ip": "192.168.0.10",
    "client_ip": "192.168.10.41",
    "domain": "spam.test.attacker.online",
    "ioc": "spam.test.attacker.online",
    "identity": "wb-default-policy",
    "mobile_client_id": "",
    "device_id": "",
    "accuracy": "100",
    "threat_types": [
        "spam"
    ],
    "app_blocked_intersect": [],
    "scheduled_internet": "false",
    "policy_name": "",
    "policy_group_id": "",
    "policy_tags": "",
    "pin": "0",
    "region": "eu-01",
    "segment_id": "",
    "brand_id": "",
    "subscription_id": "",
    "answer": "SINKHOLE_IP",
    "sinkhole_type": "8",
    "port": "63559",
    "type": "HTTPS",
    "rcode": "0",
    "matrix": {
        "accuracy_audit": "true",
        "accuracy_block": "true",
        "content": "false",
        "advertisement": "false",
        "legal": "false",
        "whitelist": "false",
        "blacklist": "false",
        "bypass": "false",
        "apps_blocked": "false",
        "apps_allowed": "false"
    }
}
```

--------------------------------

### sysinfo action output

Source: https://docs.whalebone.io/en/immunity/resolver_agent.html

Example JSON output returned by the sysinfo action, providing system status data including hostname, hardware usage, resolver metrics, and container status.

```json
{
   "hostname":"hostname",
   "system":"Linux",
   "platform":"CentOS Linux 7 (Core)",
   "cpu":{
      "count":4,
      "usage":28.6
   },
   "memory":{
      "total":7.6,
      "available":3.9,
      "usage":49.2
   },
   "hdd":{
      "total":50.0,
      "free":14.4,
      "usage":71.1
   },
   "swap":{
      "total":0.0,
      "free":0.0,
      "usage":0
   },
   "resolver":{
      "answer.nxdomain":3284,
      "answer.tc":35,
      "answer.ad":849,
      "answer.100ms":3983,
      "answer.cd":6,
      "answer.1500ms":74,
      "answer.slow":215,
      "answer.rd":224337,
      "answer.1ms":104683,
      "answer.servfail":215,
      "predict.epoch":24,
      "query.dnssec":6,
      "answer.250ms":14941,
      "query.edns":35498,
      "answer.cached":86713,
      "answer.nodata":3622,
      "answer.aa":2362,
      "answer.do":6,
      "answer.edns0":35498,
      "answer.ra":224337,
      "predict.queue":0,
      "answer.total":224337,
      "answer.10ms":35351,
      "answer.noerror":217216,
      "answer.50ms":59766,
      "answer.500ms":4642,
      "answer.1000ms":653,
      "predict.learned":80
   },
   "docker":{
      "Platform":{
         "Name":""
      },
      "Components":[
         {
            "Name":"Engine",
            "Version":"17.12.1-ce",
            "Details":{
               "ApiVersion":"1.35",
               "Arch":"amd64",
               "BuildTime":"2022-02-27T22:17:54.000000000+00:00",
               "Experimental":"false",
               "GitCommit":"88888fc6",
               "GoVersion":"go1.999.999",
               "KernelVersion":"3.22.66-693.21.1.el7.x86_64",
               "MinAPIVersion":"1.99",
               "Os":"linux"
            }
         }
      ],
      "Version":"19.32.1-ce",
      "ApiVersion":"1.98",
      "MinAPIVersion":"1.12",
      "GitCommit":"7390fc6",
      "GoVersion":"go1.9.4",
      "Os":"linux",
      "Arch":"amd64",
      "KernelVersion":"3.10.0-693.21.1.el7.x86_64",
      "BuildTime":"2018-02-27T22:17:54.000000000+00:00"
   },
   "check":{
      "resolve":"ok",
      "port":"ok"
   },
   "containers":{
      "lr-agent":"running",
      "passivedns":"running",
      "resolver":"running",
      "kresman":"running",
      "pcpy":"running",
      "logrotate":"running",
      "logstream":"running"
   },
   "images":{
      "lr-agent":"whalebone/agent:1.1.1",
      "passivedns":"whalebone/passivedns:1.1.1",
      "resolver":"whalebone/kres:1.1.1",
      "kresman":"whalebone/kresman:1.1.1",
      "logrotate":"whalebone/logrotate:1.1.1",
      "logstream":"whalebone/logstream:1.1.1"
   },
   "error_messages":{
   },
   "interfaces":[
      {
         "name":"lo",
         "addresses":[
            "127.0.0.1",
            "::1",
            "00:00:00:00:00:00"
         ]
      },
      {
         "name":"eth0",
         "addresses":[
            "1.1.1.1",
            "::c8",
            "fe80::",
            "00:00:00:00:00:00"
         ]
      },
      {
         "name":"docker0",
         "addresses":[
            "198.1.1.1",
            "00:00:00:00:00:00"
         ]
      }
   ]
}
```

--------------------------------

### Test URL Output Showing SAML Attributes

Source: https://docs.whalebone.io/en/immunity/sso_troubleshooting.html

Example of a test URL response showing the SAML response with the role key claim 'http://schemas.microsoft.com/ws/2008/06/identity/claims/role' containing 'Domain Admins' and 'Domain Users'. This whole claim name should be used in the Role key field of the SSO configuration.

```json
{
  "aud": "https://login.whalebone.io/sso/12345678-90ab-cdef-1234-567890abcdef/",
  "exp": 1771579797,
  "iat": 1771576197,
  "iss": "https://login.whalebone.io/sso/12345678-90ab-cdef-1234-567890abcdef/",
  "nbf": 1771576197,
  "sub": "user@test.intra",
  "attr": {
    "SessionIndex": [
      "_c3148bb6-4b6a-40e3-b0b3-88ba4b99da32"
    ],
    "http://schemas.microsoft.com/ws/2008/06/identity/claims/role": [
      "Domain Admins",
      "Domain Users"
    ]
  },
  "saml-session": true
}
```

--------------------------------

### Enable Prometheus Metrics with modules.load('http') and net.listen

Source: https://docs.whalebone.io/en/immunity/knot_tips_tricks.html

Enables the HTTP module and exposes the /metrics endpoint on 127.0.0.1:8453 for Prometheus metrics. The pcall is used to handle potential errors.

```lua
modules.load('http')
function startHttp ()
net.listen('127.0.0.1', 8453, { kind = 'webmgmt' })
end
pcall(startHttp)

```

--------------------------------

### Create /certs directory

Source: https://docs.whalebone.io/en/immunity/blocking_pages.html

Create a dedicated directory for certificates. This is the first step in setting up a custom CA for signing blocking pages.

```bash
mkdir /certs

```

```ini
[req]
x509_extensions = v3_ca_extensions
distinguished_name = req_dn
[v3_ca_extensions]
basicConstraints = critical,CA:TRUE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
subjectAltName = @alt_names
[alt_names]
DNS.1 = localhost
[req_dn]
countryName = Country Name (2 letter code)
countryName_default = US
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = New York
localityName = Locality Name (eg, city)
localityName_default = New York City
organizationName = Organization Name (eg, company)
organizationName_default = My Organization
commonName = Common Name (eg, your name or your server's hostname)
commonName_max = 64

```

```bash
openssl ecparam -name prime256v1 -genkey -noout -out /certs/ca.key

```

```bash
openssl req -x509 -new -nodes -key /certs/ca.key -sha256 -days 3650 -out /certs/ca.crt -config /certs/v3_cfg

```

```bash
openssl pkcs12 -export -out /certs/ca.pfx -inkey /certs/ca.key -in /certs/ca.crt -certpbe PBE-SHA1-3DES -keypbe PBE-SHA1-3DES -export -macalg sha1

```

--------------------------------

### Run pending resolver command with ./cli.sh run

Source: https://docs.whalebone.io/en/immunity/resolver_agent.html

Executes the awaiting command. The output shows a success status for the resolver.

```bash
./cli.sh run
```

```text
{'resolver': {'status': 'success'}

```

--------------------------------

### Disable QNAME Minimization with policy.FLAGS('NO_MINIMIZE')

Source: https://docs.whalebone.io/en/immunity/knot_tips_tricks.html

Disables QNAME minimization for the specified domain 'domain.com' by adding a policy with the NO_MINIMIZE flag.

```lua
policy.add(policy.suffix(policy.FLAGS('NO_MINIMIZE'), {todname('domain.com')}))

```

--------------------------------

### v3_cfg certificate configuration

Source: https://docs.whalebone.io/en/immunity/blocking_pages.html

Configuration file for generating the CA certificate. Defines certificate extensions and distinguished name fields. Do not change the [req] and [v3_ca_extensions] values. In [alt_names], list multiple resolvers using actual hostnames (e.g., DNS.1 = WB1, DNS.2 = WB2). The first line in [req_dn] is for administrative identification; the line with _default determines the data encoded into the certificate. commonName represents the blocking page (e.g., company name, resolver hostname, or Whalebone Blocking Page).

```ini
[req]
x509_extensions = v3_ca_extensions
distinguished_name = req_dn
[v3_ca_extensions]
basicConstraints = critical,CA:TRUE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
subjectAltName = @alt_names
[alt_names]
DNS.1 = localhost
[req_dn]
countryName = Country Name (2 letter code)
countryName_default = US
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = New York
localityName = Locality Name (eg, city)
localityName_default = New York City
organizationName = Organization Name (eg, company)
organizationName_default = My Organization
commonName = Common Name (eg, your name or your server's hostname)
commonName_max = 64

```

--------------------------------

### Deny list of domains with policy.suffix and policy.DENY

Source: https://docs.whalebone.io/en/immunity/knot_tips_tricks.html

Use this snippet to deny specific domains, returning NXDOMAIN for them. The policy module is loaded and the suffix policy with DENY is applied.

```lua
-- load modules
modules = {'policy'}

--define list of denied domains
domains = {
  'example.com',
  'anotherexample.org'
}

-- deny list of domains, while returning NXDOMAIN
for i,domain in ipairs(domains) do
  policy.add(policy.suffix(policy.DENY, {todname(domain)}))
end

```

--------------------------------

### Allow list of domains with policy.suffix and policy.PASS

Source: https://docs.whalebone.io/en/immunity/knot_tips_tricks.html

Use this snippet to allow only specific domains. Queries for domains not in the list are not explicitly allowed and will be subject to other policies. The policy module is loaded and the suffix policy with PASS is applied.

```lua
-- load modules
modules = {'policy'}

--define list of allowed domains
domains = {
  'example.com',
  'anotherexample.org'
}

-- allow list of domains
for i,domain in ipairs(domains) do
  policy.add(policy.suffix(policy.PASS, {todname(domain)}))
end

```

--------------------------------

### List pending resolver changes with ./cli.sh list

Source: https://docs.whalebone.io/en/immunity/resolver_agent.html

Lists the awaiting command and the changes that would be made to the containers specified in the awaiting action. This action is intended for human check. The output shows the new and old values for the resolver label.

```bash
./cli.sh list
```

```text
-------------------------------
Changes for resolver
New value for label: resolver-1.1.1

        Old value for label: resolver-1.0.0
-------------------------------

```

--------------------------------

### Export CA to PFX with openssl pkcs12

Source: https://docs.whalebone.io/en/immunity/blocking_pages.html

Export the private key and certificate to a PFX file. You will be prompted to create a password during this step; the certificate cannot be applied without this password. The output is /certs/ca.pfx.

```bash
openssl pkcs12 -export -out /certs/ca.pfx -inkey /certs/ca.key -in /certs/ca.crt -certpbe PBE-SHA1-3DES -keypbe PBE-SHA1-3DES -export -macalg sha1

```

--------------------------------

### Create CA certificate with openssl req

Source: https://docs.whalebone.io/en/immunity/blocking_pages.html

Create the CA certificate based on the v3_cfg configuration. The certificate is valid for 3650 days and saved to /certs/ca.crt.

```bash
openssl req -x509 -new -nodes -key /certs/ca.key -sha256 -days 3650 -out /certs/ca.crt -config /certs/v3_cfg

```

--------------------------------

### Allow particular IP ranges with view:addr and policy.PASS

Source: https://docs.whalebone.io/en/immunity/knot_tips_tricks.html

Use this snippet to allow only specific IP ranges to use the resolver. Queries from all other ranges are refused with DENY. The list includes 127.0.0.1/32 as a comment, and the view module is loaded along with policy.

```lua
-- load modules
modules = {'policy', 'view'}

--define list of ranges to allow
--127.0.0.1 should always be allowed
allowed = {
  '127.0.0.1/32',
  '10.10.20.5/32',
  '10.30.10.0/24'
}

-- allow list of ranges
for i,subnet in ipairs(allowed) do
  view:addr(subnet, policy.all(policy.PASS))
end

-- block all other ranges
view:addr('0.0.0.0/0', policy.all(policy.DENY))

```

--------------------------------

### Resolve Whalebone resolver list with dig

Source: https://docs.whalebone.io/en/immunity/hos_overview.html

Run this command to obtain the list of Whalebone cloud resolvers that must be allowed through the firewall. The output is a TXT record containing the resolver addresses. The list may change over time, so check it regularly.

```bash
dig hos.whalebone.io TXT

```

--------------------------------

### Resolver insufficient hardware resources alert message format

Source: https://docs.whalebone.io/en/immunity/alerts.html

Webhook and syslog message format for the resolver insufficient hardware resources alert. Contains client and resolver identifiers, hostname, timestamp, CPU, memory, and disk usage percentages, and the alert name.

```json
{
   "client_name": "string",
   "client_id": "number",
   "resolver_id": "number",
   "hostname": "string",
   "timestamp": "date",
   "CPU-usage": "number",
   "Memory-usage": "number",
   "Disk-usage": "number",
   "Alert-name": "string"
}

```

--------------------------------

### Uninstallation Command (Windows)

Source: https://docs.whalebone.io/en/immunity/hos_installation.html

Command to uninstall Whalebone Home Office Security on Windows.

```bash
msiexec /x "Whalebone.Home.Office.Security.Installer.msi"
```

--------------------------------

### containers action output

Source: https://docs.whalebone.io/en/immunity/resolver_agent.html

Output of the containers action, which lists the containers and their information including labels, image, name, and status. The action takes no parameters.

```json
[
   {
      "id":"b8f4489379",
      "image":{
         "id":"c893b4df5ca3",
         "tags":[
            "whalebone/agent:1.1.1"
         ]
      },
      "labels":{
         "lr-agent":"1.1.1"
      },
      "name":"lr-agent",
      "status":"running"
   },
   {
      "id":"e433d58f13",
      "image":{
         "id":"2c4b84a7daee",
         "tags":[
            "whalebone/passivedns:1.1.1"
         ]
      },
      "labels":{
         "passivedns":"1.1.1"
      },
      "name":"passivedns",
      "status":"running"
   },
   {
      "id":"2aeec00121",
      "image":{
         "id":"fc442e625539",
         "tags":[
            "whalebone/kres:1.1.1"
         ]
      },
      "labels":{
         "resolver":"1.1.1"
      },
      "name":"resolver",
      "status":"running"
   },
   {
      "id":"662dac2e6c",
      "image":{
         "id":"b37d0d1bd10b",
         "tags":[
            "whalebone/kresman:1.1.1"
         ]
      },
      "labels":{
         "kresman":"1.1.1"
      },
      "name":"kresman",
      "status":"running"
   },
   {
      "id":"05188ac1df",
      "image":{
         "id":"5b50cdc924fc",
         "tags":[
            "whalebone/logrotate:1.1.1"
         ]
      },
      "labels":{
         "logrotate":"1.1.1"
      },
      "name":"logrotate",
      "status":"running"
   },
   {
      "id":"01e64dd697",
      "image":{
         "id":"fffb52c2dadd",
         "tags":[
            "whalebone/logstream:1.1.1"
         ]
      },
      "labels":{
         "logstream":"1.1.1"
      },
      "name":"logstream",
      "status":"running"
   }
]

```

--------------------------------

### nslookup DNS resolution check

Source: https://docs.whalebone.io/en/immunity/quickstart.html

Use this command to manually verify that DNS traffic is being forwarded to the Whalebone resolver. It resolves an existing domain name (whalebone.io) and shows the resolver's IP address in the response. If no traffic appears in the DNS traffic view, this check helps confirm the resolver configuration.

```text
localhost:~$ nslookup whalebone.io
Server:         193.32.92.32
Address:        193.32.92.32#53

Non-authoritative answer:
Name:   whalebone.io
Address: 75.2.70.75
Name:   whalebone.io
Address: 99.83.190.102

```

--------------------------------

### Disable Query Case Randomization with policy.FLAGS('NO_0X20')

Source: https://docs.whalebone.io/en/immunity/knot_tips_tricks.html

Disables query case randomization (0x20) for the specified domain 'domain.com' by adding a policy with the NO_0X20 flag.

```lua
policy.add(policy.suffix(policy.FLAGS('NO_0X20'), {todname('domain.com')}))

```

--------------------------------

### Generate CA key with openssl ecparam

Source: https://docs.whalebone.io/en/immunity/blocking_pages.html

Generate the CA private key using elliptic curve prime256v1. The key is saved to /certs/ca.key.

```bash
openssl ecparam -name prime256v1 -genkey -noout -out /certs/ca.key

```

--------------------------------

### Refuse particular IP ranges with view:addr and policy.REFUSE

Source: https://docs.whalebone.io/en/immunity/knot_tips_tricks.html

Use this snippet to block specific IP ranges from using the resolver. Queries from all other ranges are allowed. The blocked ranges are defined in the 'blocked' list and the view module is loaded.

```lua
-- load modules
modules = {'policy', 'view'}

--define list of ranges to block
blocked = {
  '10.10.20.5/32',
  '10.30.10.0/24'
}

-- block list of ranges
for i,subnet in ipairs(blocked) do
  view:addr(subnet, policy.all(policy.REFUSE))
end

```

--------------------------------

### Disable Domain caching with policy.FLAGS('NO_CACHE')

Source: https://docs.whalebone.io/en/immunity/knot_tips_tricks.html

Disables domain caching for the specified domain 'domain.com' by adding a policy with the NO_CACHE flag.

```lua
policy.add(policy.suffix(policy.FLAGS('NO_CACHE'), {todname('domain.com')}))

```

--------------------------------

### Remove resolver configuration files

Source: https://docs.whalebone.io/en/immunity/uninstalling.html

Removes all resolver configuration files and related data. Execute after Docker is uninstalled.

```bash
rm -rf /etc/whalebone
rm -rf /var/whalebone
rm -rf /var/lib/kres

```

--------------------------------

### Syslog message format for increased percentage of queries alert

Source: https://docs.whalebone.io/en/immunity/alerts.html

Shows the syslog message template for the spike alert, including placeholders for query type, percentage, and timestamp.

```text
Whalebone detected spike in %QUERY_TYPE% requests of more than %PERCENT% at %TIMESTAMP%.
```

--------------------------------

### updatecache action output

Source: https://docs.whalebone.io/en/immunity/resolver_agent.html

Output of the updatecache action, which forces the resolver's IoC cache to update and refresh the malicious domain cache. The action takes no parameters.

```json
{'status': 'success', 'message': 'Cache update successful'}

```

--------------------------------

### Webhook and syslog message format for unique requests from IP alert

Source: https://docs.whalebone.io/en/immunity/alerts.html

Shows the JSON webhook message format for DNS traffic unique request alert; syslog format is not shown.

```json
{
   "client_name": "string",
   "alert": "string",
   "IP address": "string",
   "Number of requests": "number",
   "timestamp": "date"
}
```

--------------------------------

### Newly blocked domain alert message format

Source: https://docs.whalebone.io/en/immunity/alerts.html

Webhook and syslog message format for the newly blocked domain alert. Contains client_name, client_id, resolver_id, timestamp, domain, and client fields.

```json
{
   "client_name": "string",
   "client_id": "number",
   "resolver_id": "number",
   "timestamp": "date",
   "domain": "string",
   "client": "string"
}

```

--------------------------------

### Stop and remove Docker containers

Source: https://docs.whalebone.io/en/immunity/uninstalling.html

Stops and removes all running Docker containers, including the local resolver agent. Use this on a dedicated host where no other services run as containers.

```bash
docker rm -f lr-agent && docker rm -f $(docker ps -q)

```

--------------------------------

### Disable DNSSEC validation for a domain with trust_anchors.set_insecure

Source: https://docs.whalebone.io/en/immunity/knot_tips_tricks.html

Disables DNSSEC validation for the specified domain 'domain.com' by marking it as insecure.

```lua
trust_anchors.set_insecure({ 'domain.com' })

```

--------------------------------

### Webhook message format for increased percentage of queries alert

Source: https://docs.whalebone.io/en/immunity/alerts.html

Shows the webhook JSON message format for the increased percentage alert, including client, resolver, and timestamp fields.

```json
{
   "client_name": "string",
   "client_id": "number",
   "resolver_id": "number",
   "timestamp": "date"
}
```

--------------------------------

### Disable DNSSEC globally with trust_anchors.negative

Source: https://docs.whalebone.io/en/immunity/knot_tips_tricks.html

Disables DNSSEC validation globally by setting the negative trust anchor to the root. This affects all domains.

```lua
trust_anchors.negative = { '.' }

```

--------------------------------

### Webhook and syslog message format for DNSSEC error detection alert

Source: https://docs.whalebone.io/en/immunity/alerts.html

JSON message format for the DNSSEC error detection alert. Includes fields for client name, client ID, alert type, Level2 domain, query, query type, timestamp, client IP, and EDE code.

```json
{
   "client_name": "string",
   "client_id": "number",
   "alert": "string",
   "Level2 domain": "string",
   "Query": "string",
   "Query type": "string",
   "Timestamp (UTC)": "date",
   "Client IP": "string",
   "EDE Code": "number"
}
```

--------------------------------

### DNS tunneling alert message format

Source: https://docs.whalebone.io/en/immunity/alerts.html

Webhook and syslog message format for the DNS tunneling alert. Contains fields identifying the client, the alert name, the queried domain, the DNS query and type, the timestamp, and the client IP.

```json
{
   "client_name": "string",
   "client_id": "number",
   "alert": "string",
   "Level2 domain": "string",
   "Query": "string",
   "Query type": "string",
   "Timestamp (UTC)": "date",
   "Client IP": "string"
}

```

--------------------------------

### Delete pending resolver request with ./cli.sh delete_request

Source: https://docs.whalebone.io/en/immunity/resolver_agent.html

Deletes the awaiting request. The output confirms the deletion.

```bash
./cli.sh delete_request
```

```text
Pending configuration request deleted.

```

--------------------------------

### Remove DNS traffic and incidents logs

Source: https://docs.whalebone.io/en/immunity/uninstalling.html

Deletes DNS traffic and incidents logs. Skip this step if you intend to re-install the resolver but keep the logs.

```bash
rm -rf /var/log/whalebone

```

--------------------------------

### Webhook and syslog message format for homograph attack alert

Source: https://docs.whalebone.io/en/immunity/alerts.html

JSON message format for the homograph attack alert. Includes fields for client name, client ID, alert type, Level2 domain, query, query type, timestamp, and client IP.

```json
{
   "client_name": "string",
   "client_id": "number",
   "alert": "string",
   "Level2 domain": "string",
   "Query": "string",
   "Query type": "string",
   "Timestamp (UTC)": "date",
   "Client IP": "string"
}
```

--------------------------------

### Resolver - Resolution service failure alert message format

Source: https://docs.whalebone.io/en/immunity/alerts.html

Webhook and syslog message format for the Resolver - Resolution service failure alert. The message includes the subject, client name and ID, resolver ID, hostname, and timestamp.

```json
{
   "subject": "DNS resolution failure",
   "client_name": "string",
   "client_id": "number",
   "resolver_id": "number",
   "hostname": "string",
   "timestamp": "date"
}

```

--------------------------------

### Threats - event detection alert message format

Source: https://docs.whalebone.io/en/immunity/alerts.html

Webhook and syslog message format for the Threats - event detection alert. The message includes client name, domain, client, country code, client ID, timestamp, action, and threat type filter.

```json
{
   "client_name": "string",
   "domain": "string",
   "client": "string",
   "country_code2": "string",
   "client_id": "number",
   "timestamp": "date",
   "action": "string",
   "threat_type_filter": "string"
}

```

--------------------------------

### Resolver cloud communication failure alert message format

Source: https://docs.whalebone.io/en/immunity/alerts.html

Webhook and syslog message format for the resolver cloud communication failure alert. Contains client and resolver identifiers and the timestamp of the failure.

```json
{
   "client_name": "string",
   "client_id": "number",
   "resolver_id": "number",
   "timestamp": "date"
}

```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.