Changing the order or blocklists?

[HachimanSec]

Hi everyone,
I was wondering if one can change the order of the blocklists?

The thing is I want to have certain blocklists, like abuse.ch, with more specific results before more generic, large ones like HaGeZi.

As we are feeding the log into our SIEM I want to first hit the more specific abuse.ch to send out an alert.

So far almost everything hits HaGeZi but never the abuse.co blocklist.

Any idea how this can be achieved?
Thx!

[Dynamic5912]

All the blocklists are checked. I don't think the order in which they are checked can be modified.

[HachimanSec]

That is what I thought too @ppfeufer
Unfortunately it seems like it still doesnt work.

This is the order of the blocklists (snippet):

filters:
  - enabled: true
    url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt
    name: AdGuard DNS filter
    id: 1
  - enabled: true
    url: https://urlhaus.abuse.ch/downloads/rpz/
    name: URLhaus abuse.ch
    id: 1710998425
  - enabled: true
    url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_12.txt
    name: Dandelion Sprout's Anti-Malware List
    id: 1710998426
  - enabled: true
    url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_44.txt
    name: HaGeZi's Threat Intelligence Feeds
    id: 1710998427

abuse.ch is listed before HaGeZi.

Looking at the abuse.ch list: https://urlhaus.abuse.ch/downloads/rpz/

I choose this for testing: fransize-veryf[.]com

Looking at the log (see screenshot) the hostname is blocked by HaGeZi instead of abuse.ch - even though abuse.ch is the first list I had added and it has the lowest list id in the conf.

[ppfeufer]

That because the domain you're testing is not in there

[HachimanSec]

Right I did a copy paste error. But this one is: arting[.]ee

Same result.

[ppfeufer]

Erm, that list is not AdGuard Syntax.
Try this one » https://malware-filter.gitlab.io/malware-filter/urlhaus-filter-agh.txt

[HachimanSec]

Thanks @ppfeufer . I was literally using the wrong format list. Now it works. Really appreciate it!