code: def packetbeat_blacklisted_domain(rec):
      """
      author:       gavin (gavinelder)
      description:  Lookup for BlackListed DNS (CnC).
      testing:      (a) Review traffic logs for machine in question.
      reference:    https://www.elastic.co/guide/en/beats/packetbeat/master/packetbeat-overview.html
      """
      return rec["dns"]["question"]["name"] in DNS_BLACKLIST
  
label_desc: Use image node_id 1 for calling a global function with example usage: packetbeat_blacklisted_domain(rec) and returns: unknown