DNSOverHttps

Query dns names over https from Cloudflare or Google

Utilities · DNSOverHttps

Details

IDDNSOverHttps
ProviderOpen Source
CategoryUtilities
From Version6.0.0
Docker Imagedemisto/python3:3.12.8.3296088
Supported ModulesAgentix XSIAM

README

Query dns names over https from Cloudflare or Google.

Configure DNSOverHttps in Cortex

Parameter Description Required
DNS over HTTPS resolver Select Cloudflare or Google DNS over HTTPS server to use True
Trust any certificate (not secure)   False
Use system proxy settings   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

doh-resolve

Resolve a name to IP over HTTPS

Base Command

doh-resolve

Input

Argument Name Description Required
domain domain you want to resolve to IP. Required
type Type of DNS records you want to get. Possible values are: A, AAAA, TXT, MX, DNSKEY, NS. Default is A. Optional
only_answers If you only want to return the answers. Possible values are: True, False. Default is True. Optional

Context Output

Path Type Description
DNSOverHTTPS.Results List DNS query results

Command Example

!doh-resolve domain=domain.com

Context Example

{
    "DNSOverHTTPS": {
        "Results": [
            {
                "TTL": 3600,
                "data": "domain.com.edgekey.net.",
                "name": "www.domain.com",
                "type": 5
            },
            {
                "TTL": 21600,
                "data": "e3130.dscg.net.",
                "name": "domain.com.edgekey.net",
                "type": 5
            },
            {
                "TTL": 20,
                "data": "111.11.11.111",
                "name": "e3130.dscg.net",
                "type": 1
            }
        ]
    }
}

Human Readable Output

Results

TTL data name type
3600 domain.com.edgekey.net. www.domain.com 5
21600 e3130.dscg.net. domain.com.edgekey.net 5
20 111.11.11.111 e3130.dscg.net 1

Configuration parameters

  • url — DNS over HTTPS resolver (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (1)

  • doh-resolve

    Resolve a name to IP over HTTPS

Source

DNSOverHttps.py DNSOverHttps.yml DNSOverHttps_description.md command_examples.txt
Download History Raw 
import ast

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def test_module(client, base_url):
    params = {"name": "paloaltonetworks.com", "type": "A"}
    result = client._http_request("GET", full_url=base_url, params=params)
    if result:
        return "ok"
    else:
        return "Test failed: " + str(result)


def run_command(client, params, base_url):
    response = client._http_request("GET", full_url=base_url, params=params)
    return response


def create_output(results, endpoint, only_answers):
    if only_answers:
        try:
            output = CommandResults(outputs_prefix=f"DNSOverHTTPS.{endpoint}", outputs_key_field="", outputs=results["Answer"])
            return output
        except LookupError:
            return "No results found"
    else:
        output = CommandResults(outputs_prefix=f"DNSOverHTTPS.{endpoint}", outputs_key_field="", outputs=results)
        return output


def main():
    # get the service API url
    base_url = demisto.params().get("url")

    verify_certificate = not demisto.params().get("insecure", False)

    proxy = demisto.params().get("proxy", False)

    headers = {"accept": "application/dns-json"}

    demisto.info(f"Command being called is {demisto.command()}")
    try:
        client = BaseClient(base_url=base_url, verify=verify_certificate, headers=headers, proxy=proxy)

        if demisto.command() == "test-module":
            # This is the call made when pressing the integration Test button.
            result = test_module(client, base_url)
            demisto.results(result)
        elif demisto.command() == "doh-resolve":
            params = {"name": demisto.args().get("domain"), "type": demisto.args().get("type")}
            only_answers = ast.literal_eval(demisto.args().get("only_answers"))
            results = run_command(client, params, base_url)
            return_results(create_output(results, "Results", only_answers))
    # Log exceptions
    except Exception as e:
        return_error(f"Failed to execute {demisto.command()} command. Error: {e!s}")


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()