This group works to define a common output format of Passive DNS Servers which clients can query. Over time, since the initial announcement of Passive DNS replication at the 17th Annual FIRST Conference on Computer Security by Florian Weimer, multiple Passive DNS Implementations were developed. This standard proposes a common output format to make Passive DNS information more universally useable.
The initial goal of this SIG was to collaboratively develop a common output format (COF) for Passive DNS data. As a result of this SIG, an Internet Draft was published on September 9th 2014.
Apart from definining the standard, farsight and the group added a MISP module called cof2misp which can import COF into MISP. There, the full power of the MISP correlation engine can be employed to find matching indicators of compromise. Therefore, by importing the COF format into MISP, we can pivot back and forth between passive DNS databases and MISP.
If you want to try out the cof2MISP module and if you are a member of FIRST, the https://misp.first.org instance has the cof2MISP module installed, and you can try correlating events. If you need to get access to passive DNS DB servers, you can ask: