DNSOverHttps

Details

ID	`DNSOverHttps`
Provider	Open Source
Category	Utilities
From Version	6.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

Query dns names over https from Cloudflare or Google.

Configure DNSOverHttps in Cortex

Parameter	Description	Required
DNS over HTTPS resolver	Select Cloudflare or Google DNS over HTTPS server to use	True
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

doh-resolve

Resolve a name to IP over HTTPS

Base Command

doh-resolve

Input

Argument Name	Description	Required
domain	domain you want to resolve to IP.	Required
type	Type of DNS records you want to get. Possible values are: A, AAAA, TXT, MX, DNSKEY, NS. Default is A.	Optional
only_answers	If you only want to return the answers. Possible values are: True, False. Default is True.	Optional

Context Output

Path	Type	Description
DNSOverHTTPS.Results	List	DNS query results

Command Example

!doh-resolve domain=domain.com

Context Example

{
    "DNSOverHTTPS": {
        "Results": [
            {
                "TTL": 3600,
                "data": "domain.com.edgekey.net.",
                "name": "www.domain.com",
                "type": 5
            },
            {
                "TTL": 21600,
                "data": "e3130.dscg.net.",
                "name": "domain.com.edgekey.net",
                "type": 5
            },
            {
                "TTL": 20,
                "data": "111.11.11.111",
                "name": "e3130.dscg.net",
                "type": 1
            }
        ]
    }
}

Human Readable Output

Results

TTL data name type

3600 domain.com.edgekey.net. www.domain.com 5

21600 e3130.dscg.net. domain.com.edgekey.net 5

20 111.11.11.111 e3130.dscg.net 1

TTL	data	name	type
3600	domain.com.edgekey.net.	www.domain.com	5
21600	e3130.dscg.net.	domain.com.edgekey.net	5
20	111.11.11.111	e3130.dscg.net	1

Configuration parameters

url — DNS over HTTPS resolver (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

doh-resolve
Resolve a name to IP over HTTPS

Source

DNSOverHttps.py DNSOverHttps.yml DNSOverHttps_description.md command_examples.txt

Download History Raw

category: Utilities
provider: Open Source
commonfields:
  id: DNSOverHttps
  version: -1
configuration:
- additionalinfo: Select Cloudflare or Google DNS over HTTPS server to use
  defaultvalue: https://cloudflare-dns.com/dns-query
  display: DNS over HTTPS resolver
  name: url
  options:
  - https://cloudflare-dns.com/dns-query
  - https://dns.google.com/resolve
  required: true
  type: 15
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Query dns names over https from Cloudflare or Google
display: DNSOverHttps
name: DNSOverHttps
script:
  commands:
  - arguments:
    - description: domain you want to resolve to IP
      name: domain
      required: true
    - auto: PREDEFINED
      defaultValue: A
      description: Type of DNS records you want to get
      name: type
      predefined:
      - A
      - AAAA
      - TXT
      - MX
      - DNSKEY
      - NS
    - auto: PREDEFINED
      defaultValue: 'True'
      description: If you only want to return the answers
      name: only_answers
      predefined:
      - 'True'
      - 'False'
    description: Resolve a name to IP over HTTPS
    name: doh-resolve
    outputs:
    - contextPath: DNSOverHTTPS.Results
      description: DNS query results
      type: list
  dockerimage: demisto/python3:3.12.8.3296088
  script: ''
  subtype: python3
  type: python
fromversion: 6.0.0
tests:
- No tests (auto formatted)