Farsight DNSDB

Details

ID	`Farsight DNSDB`
Provider	DomainTools
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Supported Modules	Agentix XSIAM

README

This integration uses Farsight Security’s DNSDB solution to interactively lookup rich, historical DNS information – either as playbook tasks or through API calls in the War Room – to access rdata and rrset records.

To set up Farsight Security DNSDB to work with Cortex XSOAR:

User will need DNSDB’s API key and service URL for connecting to the Cortex XSOAR server.

Configure Farsight DNSDB in Cortex

Parameter	Required
DNSDB Service URL	True
API Key	True
Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

dnsdb-rdata

Lookup rdata records

Base Command

dnsdb-rdata

Input

Argument Name	Description	Required
type	query type. Possible values are: name, ip, raw.	Required
value	query value.	Required
limit	Limit the number of returned records. Default is 100.	Optional
time_first_before	Filter results for entries seen for first time before (seconds).	Optional
time_last_before	Filter results for entries seen last time before (seconds).	Optional
time_first_after	filter results for entries seen first time after (seconds).	Optional
time_last_after	filter results for entries seen last time after (seconds).	Optional
rrtype	query rrtype.	Optional

Context Output

There is no context output for this command.

dnsdb-rrset

Lookup rrser records

Base Command

dnsdb-rrset

Input

Argument Name	Description	Required
owner	Owner name to query.	Required
rrtype	rrtype value to query.	Optional
bailiwick	Bailiwick value to query.	Optional
limit	Limit the number of returned records. Default is 100.	Optional
time_first_before	Filter results for entries seen for first time before (seconds).	Optional
time_first_after	Filter results for entries seen for first time after (seconds).	Optional
time_last_before	Filter results for entries seen for last time before (seconds).	Optional
time_last_after	Filter results for entries seen for last time after (seconds).	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — DNSDB Service URL (required)
apiKey — API Key
apikey_creds —
useproxy — Use system proxy settings

Commands (2)

dnsdb-rdata
Lookup rdata records
dnsdb-rrset
Lookup rrser records

Source

FarsightDNSDB.js FarsightDNSDB.yml

Download History Raw

commonfields:
  id: Farsight DNSDB
  version: -1
name: Farsight DNSDB
display: Farsight DNSDB
category: Data Enrichment & Threat Intelligence
provider: DomainTools
description: Query Farsight DNSDB service
configuration:
- display: DNSDB Service URL
  name: url
  defaultvalue: "https://api.dnsdb.info/"
  type: 0
  required: true
- display: API Key
  name: apiKey
  defaultvalue: ""
  type: 4
  hidden: true
- name: apikey_creds
  type: 9
  displaypassword: API Key
  hiddenusername: true
- defaultvalue: 'true'
  display: Use system proxy settings
  name: useproxy
  required: false
  type: 8
script:
  script: ''
  type: javascript
  commands:
  - name: dnsdb-rdata
    arguments:
    - name: type
      required: true
      auto: PREDEFINED
      predefined:
      - name
      - ip
      - raw
      description: query type
    - name: value
      required: true
      description: query value
    - name: limit
      description: Limit the number of returned records
      defaultValue: "100"
    - name: time_first_before
      description: Filter results for entries seen for first time before (seconds)
    - name: time_last_before
      description: Filter results for entries seen last time before (seconds)
    - name: time_first_after
      description: filter results for entries seen first time after (seconds)
    - name: time_last_after
      description: filter results for entries seen last time after (seconds)
    - name: rrtype
      description: query rrtype
    description: Lookup rdata records
  - name: dnsdb-rrset
    arguments:
    - name: owner
      required: true
      description: Owner name to query
    - name: rrtype
      description: rrtype value to query
    - name: bailiwick
      description: Bailiwick value to query
    - name: limit
      description: Limit the number of returned records
      defaultValue: "100"
    - name: time_first_before
      description: Filter results for entries seen for first time before (seconds)
    - name: time_first_after
      description: Filter results for entries seen for first time after (seconds)
    - name: time_last_before
      description: Filter results for entries seen for last time before (seconds)
    - name: time_last_after
      description: Filter results for entries seen for last time after (seconds)
    description: Lookup rrser records
tests:
- No tests
fromversion: 5.0.0