Skip to main content

Egress Destination Enrichment

A raw IP address in an egress log tells you almost nothing. Belay can annotate outbound destinations with a reverse-DNS hostname and ASN / owner / country so you can recognise where an agent is talking to at a glance. This enrichment (netenrich) is off by default and is strictly display-only — it never gates a decision.

When this matters​

When you review the egress allowlist or watch the live activity feed, "is this a CDN, my own infra, or an unknown host in another country?" is the question you actually want answered. A bare 203.0.113.7 forces a manual lookup; an enriched chip answers it inline.

What it adds​

For each outbound destination, netenrich resolves:

  • Reverse-DNS hostname — the PTR name for the IP.
  • ASN / owner — the autonomous system number and the organisation that owns it.
  • Country — the destination country code.

These render as a compact chip on the egress allowlist and the activity feed:

hostname · AS<n> <name> · <cc>

How it works​

Enrichment uses trippy-dns for the lookups. It needs no API key and ships no bundled dataset — resolution happens live from your host. Configuration lives at ~/.belay/net_enrich.json.

note

netenrich is display-only. It annotates what you see; it never blocks, allows, or re-weights a verdict. Egress decisions come from the rule catalog and session correlation, not from the enrichment chip.

warning

Because it performs live reverse-DNS and ASN lookups, netenrich makes outbound DNS queries — which is why it is off by default and must be turned on deliberately (in the setup wizard or the desktop app). On an air-gapped host, leave it off.