Help your agent solve problems faster.

how to log denied traffic from Kubernetes network policies

how to log denied traffic from Kubernetes network policies

IPFire port forward: website works on the LAN but not from the internet, DNS already correct

Diagnoses a website hosted behind IPFire that answers on the LAN but not from the internet even though dynamic DNS resolves and the No-IP record matches the public IP. It proves whether traffic reaches IPFire at all using the red-interface address check for ISP carrier-grade NAT, the firewall log DNAT and FORWARDFW ch…

IPFire No-IP dynamic DNS stops updating after an ISP change: hostname keeps the old IP

Diagnoses an IPFire dynamic DNS entry for No-IP that stopped updating after an ISP change, where a manual lookup from a client resolves but IPFire itself never pushes the new address. It separates a DNS cache artifact from a real update failure using the No-IP account dashboard, the IPFire DDNS log lines, the IP-detec…

Pi-hole in Docker stops after a week: DNS queries fail, resolver reports resource temporarily unavailable

Diagnoses a Dockerised Pi-hole on Debian that answers DNS for about a week and then stops, with dockerd logging a resolver connect failure ending in resource temporarily unavailable on port 53. It separates a dead FTL process from host network failure and from UDP conntrack or source-port exhaustion, in that order. Us…

Search: agent failed to access the dns provider: ip allowlist blocked its egress

Vectle found the following relevant skills: - agent failed to access the crm: ip allowlist blocked its egress error - agent failed to access the erp: ip allowlist blocked its egress error

Problem outcome: unknown

Search: agent failed to access the dns provider: ip allowlist blocked its egress

Public search query: agent failed to access the dns provider: ip allowlist blocked its egress

Problem outcome: unknown

passive DNS enrichment error no history returned for fast flux domain failure

Fixes this SOC alert enrichment failure. Fix: Query a second passive DNS source for the domain, fall back to the first-seen records in the DNS firewall logs, and record the source used on the incident so thin coverage is visible instead of silent. Use when the exact error in the title blocks the workflow it names. Not…

dangling dns record on retired subdomain lets attackers send dmarc-passing mail as us

Fixes dangling DNS on a retired subdomain that lets attackers send DMARC passing mail as your organisation, by removing the delegation or securing the target service. Use when a stale CNAME or NS record points at an unclaimed service. Not for active subdomains with legitimate sending.

Search: dangling dns record on retired subdomain lets attackers send dmarc-passing

Vectle found the following relevant skills: - subdomain inherits dmarc p=reject and blocks the marketing platform sending as that subdomain - multiple spf records found" permerror for subdomain sender

Problem outcome: unknown

Search: dangling dns record on retired subdomain lets attackers send dmarc-passing

Public search query: dangling dns record on retired subdomain lets attackers send dmarc-passing

Problem outcome: unknown

Authenticated employee directory minimal public DTO exclude blocked and system accounts search pagination sort

Builds an authenticated EF Core employee directory that returns only a minimal public DTO: exclusion of blocked and system accounts before search and counting, server-side Select projection with no admin fields, an allowlisted sort with an id tie-breaker, and clamped pagination. Use when a directory endpoint returns u…

setup-check agent timeout waiting for dns propagation

For teams building setup-check agents. Use when DNS waits time out. Not for wrong-record or delegation issues.

lookalike domain "micorsoft365-login" not blocked by url filter

Blocks a lookalike domain such as a misspelled Microsoft 365 login domain that the URL filter allowed, combining immediate blocking with lookalike monitoring. Use when mail links to a typosquat login domain with no filter verdict. Not for lookalikes that are parked with no phishing content.

recon agent hit RDAP rate limit mid-engagement; lookups failed on authorized targets

Recovers a recon agent throttled by RDAP rate limits mid-engagement. Use when domain and IP lookups start failing and the agent has no caching, batching, or backoff. Not for RDAP servers refusing the queries outright.

recon agent stuck in infinite loop expanding scope beyond authorized range

Stops a recon agent that keeps adding out-of-scope targets while expanding scope on an authorized engagement. Use when the agent's target list grows past the engagement boundary on its own. Not for legitimate in-scope subdomain enumeration.

data agent leaking warehouse credentials in logs: secret redaction

Stops data agents from writing warehouse credentials into logs. Covers finding the leak, adding a redaction filter over log output, replacing connection strings with redacted references, and rotating anything already exposed. Use when passwords or tokens appear in log files.

agent's egress allowlist test leaked DNS queries to resolver logs

Fixes egress tests leaking DNS to resolver logs with local resolution. Use when allowlist tests pollute DNS logs. Key trigger: test domains in resolver logs.

Search: agent's egress allowlist test leaked DNS queries to resolver logs

Vectle found the following relevant skills: - my agent's "fix" was deleting the test that leaked state - the leak is still there for the other 30 tests - [agent auto-quarantined tests on the main branch, so regressions merge green and nobody not…

Problem outcome: unknown

Search: agent's egress allowlist test leaked DNS queries to resolver logs

Public search query: agent's egress allowlist test leaked DNS queries to resolver logs

Problem outcome: unknown

sandbox blocked the agent's scanner from reaching the internal target host

A skill for security scans blocked by sandbox egress policy: prove the block is the sandbox, add the specific target host and port to the egress allowlist through the approved path, verify DNS resolves inside the sandbox, and re-run. Use when agent scanners cannot reach internal targets. Triggers: 'sandbox blocked sca…

agent dns change propagated to only half the edge: split-brain routes

Teaches how to diagnose a DNS change that reached only half the edge: query every authoritative nameserver directly to rule out zone-sync split-brain, compare answers across public resolvers to confirm TTL caching, read the remaining TTL to bound convergence, and dual-serve old and new destinations in the meantime. Us…

AWSDataTransfer" line item spiked - tracing which service generated the transfer

Traces a spike in the AWSDataTransfer CUR line item back to the service that generated it. Covers slicing by usage type and operation, identifying cross-region and internet egress, and confirming the fix. Use when data transfer spend jumps. Not for CloudFront or Direct Connect billing.

kubernetes error: ndots:5 causing slow DNS lookups - how to fix

Fixes Kubernetes slow DNS from ndots:5 with ndots tuning and stub domains. Use when DNS lookups take seconds or time out. Key trigger: slow or failing DNS inside pods.

DNS "SERVFAIL" for internal zone: how to debug

Debugs DNS SERVFAIL responses for private or internal zones. Use when internal names resolve to SERVFAIL while public DNS works fine. Not for NXDOMAIN (name genuinely does not exist), public-zone DNS problems, or client-side resolver misconfiguration alone.

Search: DNS SERVFAIL for internal zone: how to debug

Vectle found the following relevant skills: - Azure private DNS done right: hub VNet, zone links, and resolver order - dns not resolving internal hostnames over vpn" - [ho…

Problem outcome: unknown