Add a minimum TTL to auditbeat reverse DNS resolution

[ansell]

Describe the enhancement:

I am having an issue with auditbeat performing reverse DNS resolution too often. However, it doesn't look like a bug, as the responses seem to have TTL: 0, and based on the documentation it appears as though that response value is honoured and the responses are never cached by design:

https://www.elastic.co/guide/en/beats/auditbeat/master/processor-dns.html

Describe a specific use case for the enhancement or feature:

It would be very useful for me to be able to configure a minimum TTL for caching successful auditbeat reverse DNS resolutions to allow TTL: 0 responses to be cached for the minimum configured time rather than never cached.

Reverse DNS requests are generally out-of-system requests, so there is also the potential for DoS if malicious users are aware of the use of auditbeat reverse DNS resolution and this issue.

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[andrewkroh]

It's probably a pretty simple enhancement to make if anyone is interested in contributing. It would involve adding a new configuration option to the success cache then update the code to set a minimum bound on the cache TTL value. It would need a test case and docs update too.

beats/libbeat/processors/dns/config.go

Lines 84 to 88 in bfe773e

	// CacheSettings define the caching behavior for an individual cache.
	type CacheSettings struct {
	// TTL value for items in cache. Not used for success because we use TTL
	// from the DNS record.
	TTL time.Duration `config:"ttl"`

beats/libbeat/processors/dns/cache.go

Line 52 in bfe773e

expires: now.Add(time.Duration(ptr.TTL) * time.Second),

[ansell]

@andrewkroh I attempted to make the necessary changes, but not sure how to test them so I am not sure if they are actually working. I have previously been using the dns processor with the auditbeat system socket module that doesn't seem to be open sourced. I have signed the CLA, so feel free to take this commit and complete it:

ansell@b736d97

[andrewkroh]

hey @ansell, can you please open a PR with that patch? I can take a look at it and try to push in some unit tests to go with it.

[ansell]

@andrewkroh PR is at #18986 . I have enabled "Maintainer push access" to the branch.