Additional Fields - adulau/pdns-qof GitHub Wiki

If passive dns software developers require new extension, the registration of additional field is done on this page (fetch, modify and pull). The additional fields requested will be reviewed before being merged.

The registration process follows the recommendations from RFC6648 regarding extension registration.

Additional Field name	Description	Requester	Status
sensor_id	This field returns the sensor information where the record was seen. The sensor_id is an opaque byte string as defined by RFC 5001 in section 2.3. The sensor_id MUST be escaped as defined in section 2.6 of RFC4627. This field is represented as a JSON string.	CERT.at	Implemented in the standard
zone_time_first	This field returns the first time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import. The date is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone MUST be UTC. This field is represented as a JSON number.	DNSDB	Implemented in the standard
zone_time_last	This field returns the last time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import. The date is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone MUST be UTC. This field is represented as a JSON number.	DNSDB	Implemented in the standard
time_first_rfc3339	This field returns the first time that the record / unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS. The date is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone MUST be UTC. This field is represented as a JSON [RFC4627] string and displays the time_first value in a human readable version according to RFC 3339.	balboa	Open
time_last_rfc3339	This field returns the last time that the record / unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS. The date is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone MUST be UTC. This field is represented as a JSON [RFC4627] string and displays the time_last value in a human readable version according to RFC 3339.	balboa	Open
meta	meta contains a list of custom defined JSON key value pairs. Additional meta field MAY be added without the need to be referenced or registered in advance.	CIRCL	Registered