Handle parsing of SRV records

suricata_/helper.py

@@ -81,8 +81,13 @@ def attach_network_connection(data: dict):
     # Populate reverse lookup map
     for record in event_types["dns"]:
         domain = record["dns"]["rrname"]
-        for lookup_type, resolved_ips in record["dns"].get("grouped", {}).items():
-            [reverse_lookup.update({ip: domain}) for ip in resolved_ips]
+        if record["dns"].get("rrtype") == "SRV":
+            # These kinds of records have to be parsed differently
+            for answer in record["dns"].get("additionals", []):
+                reverse_lookup[answer["rdata"]] = answer["rrname"]
+        else:
+            for lookup_type, resolved_ips in record["dns"].get("grouped", {}).items():
+                reverse_lookup.update({ip: domain for ip in resolved_ips})
 
     for record in ordered_records:
         timestamp = dateparser.parse(record["timestamp"]).isoformat(" ")