Query Store & Forward (QSAF)

A Docker Container used to Store & Forward DNS Queries.

Overview • Documentation • Feature Requests • License •

Overview

QSAF was designed to provide a means of passive DNS log collection for the purpose of an Infoblox Security Assessment.

You can collect DNS Syslog data in various formats, which can then be replayed as DNS queries in real time or stored for replaying at a later time.

Collected data will retain the original Source IP during replayed queries when sending them to the Infoblox Threat Defense Cloud Resolvers.

Check out the Documentation site for Installation & Usage information.

Docker Compose Example

version: '3'

services:
  qsaf:
    image: ghcr.io/tehmuffinmoo/qsaf:latest
    ports:
      - 514:514/udp
    environment:
      HWID: RANDOM
      LOGLEVEL: INFO
    restart: always
    volumes:
      - ./config.ini:/home/qsaf/config.ini
      - ./logs:/var/log/syslog-ng

Feature Requests

• If the feature you are looking for is not yet built into the QSAF Container, you can raise a feature request via Github Issues.

License

MIT

---

Mat Cox