# ============================================================================
# loghunter — Your own DNS allowlist (local additions)
# ============================================================================
#
# THIS FILE IS YOURS. It ships EMPTY on purpose. Put your own known-good DNS
# names here when you want to suppress them WITHOUT editing the curated lists
# that ship with loghunter (domains_common.txt / domains_devices.txt).
#
# WHERE IT LIVES (important — read this)
#   This package copy is just a starter template. loghunter reads from your
#   allowlist.d (under [loghunter].root — ~/.loghunter/allowlist.d/ by default).
#   It auto-discovers drop-ins there by filename convention:
#         ~/.loghunter/allowlist.d/domains_user.txt   (this template)
#         ~/.loghunter/allowlist.d/domains_*.txt       (ANY name works — additive)
#   Copy this file there and add your patterns, or use any domains_*.txt name you
#   like (domains_site.txt, etc.). That location:
#     * loads ON TOP of the curated shipped lists (purely additive), and
#     * is OUTSIDE the installed package, so a `pip install -U` upgrade of
#       loghunter never clobbers your edits.
#   Every domains_*.txt drop-in is ADDITIVE — even one named after a shipped list
#   (domains_common.txt, etc.). To replace a curated list instead of adding to it,
#   turn it off: `loghunter allowlist disable common`.
#   (TOML classification stanzas — *.toml in allowlist.d/ — and the numeric
#   connection allowlist, connections*.txt, live in that same folder.)
#
# WHAT BELONGS HERE
#   Your site's own infrastructure and habitual destinations: internal services,
#   self-hosted apps, vendor portals you trust, monitoring/telemetry you don't
#   want to hunt within — anything that is noise FOR YOU but not for everyone.
#
# HOW SUPPRESSION WORKS (it has teeth)
#   Allowlisting happens BEFORE detection. Any DNS name matched here is removed
#   from the data the detectors ever see — it cannot produce a finding. Add a
#   name only when you genuinely never want to hunt within it.
#
# FORMAT
#   One pattern per line. '#' starts an inline or full-line comment. Blank
#   lines ignored.
#     * Plain text -> fnmatch glob, e.g. *.internal.example.com
#     * "re:" prefix -> Python regex (re.search), e.g. re:\.example\.net$
#   Anchored suffix regex ( re:\.example\.com$ ) matches the bare registered
#   domain AND every subdomain.
#
# EXAMPLES (commented out — uncomment / replace with your own)
#   re:\.corp\.example\.com$ # your internal domain
#   *.grafana.example.net # a self-hosted dashboard
#   re:\.my-monitoring-vendor\.com$ # telemetry you don't hunt within
#
# DISCLAIMER
#   Patterns you add here suppress real data before analysis. Keep this list
#   tight and review it periodically — an over-broad entry can hide signal.
# ============================================================================

# Add your patterns below this line.
