JsonWhoIs
Provides data enrichment for domains and IP addresses.
Data Enrichment & Threat Intelligence · JsonWhoIs
Details
| ID | JsonWhoIs |
|---|---|
| Provider | JsonWhois |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 5.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
Use the JsonWhoIs integration to enrich domain indicators.
Configure JsonWhoIs in Cortex
| Parameter | Description | Example |
|---|---|---|
| Name | A meaningful name for the integration instance. | JsonWhoIs_instance_1 |
| API Token | Your JsonWhoIs API token | N/A |
| System proxy | Runs the integration instance using the proxy server (HTTP or HTTPS) that you defined in the server configuration. | https://proxyserver.com |
| Trust any certificate (not secure) | When selected, certificates are not checked. | N/A |
| Do Not Use by Default | If checked the commands will not be used by default (this is influenced if two command are the same). | N/A |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
Get enriched data
Returns enriched data for Domains, URLs, and IP addresses.
Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.
Base Command
whois
Input
| Argument Name | Description | Required |
|---|---|---|
| query | The URL, IP address, or domain to enrich. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Domain.WHOIS.DomainStatus | Boolean | Whether the domain is registered. |
| Domain.WHOIS.NameServers | String | The name servers. |
| Domain.WHOIS.CreationDate | Date | The creation date. |
| Domain.WHOIS.UpdatedDate | Date | The updated date. |
| Domain.WHOIS.ExpirationDate | Date | The expiration date. |
| Domain.WHOIS.Registrant.Name | String | The registrant name. |
| Domain.WHOIS.Registrant.Email | String | The registrant email. |
| Domain.WHOIS.Registrant.Phone | String | The registrant phone. |
| Domain.WHOIS.Registrar.Name | String | The registrar name. |
| Domain.WHOIS.Registrar.Url | String | The registrar email. |
| Domain.WHOIS.Registrar.Organization | String | The registrar organization name. |
| Domain.WHOIS.Registrar.Id | Number | The registrar ID. |
| Domain.WHOIS.Admin.Name | String | The Admin name. |
| Domain.WHOIS.Admin.Email | String | The Admin email. |
| Domain.WHOIS.Admin.Phone | String | The Admin phone. |
Command Example
!whois query=demisto.com
Context Example
{
"Domain": {
"WHOIS": {
"Admin": [
{
"Email": "5be9245893ff486d98c3640879bb2657.protect@whoisguard.com",
"Name": "WhoisGuard Protected",
"Phone": "+507.8365503"
}
],
"CreationDate": "2015-01-16T21:36:27.000Z",
"DomainStatus": "registered",
"ExpirationDate": "2026-01-16T21:36:27.000Z",
"NameServers": [
{
"Name": "pns31.cloudns.net"
},
{
"Name": "pns32.cloudns.net"
},
{
"Name": "pns33.cloudns.net"
},
{
"Name": "pns34.cloudns.net"
}
],
"Registrant": [
{
"Email": "5be9245893ff486d98c3640879bb2657.protect@whoisguard.com",
"Name": "WhoisGuard Protected",
"Phone": "+507.8365503"
}
],
"Registrar": {
"Id": "1068",
"Name": "NameCheap, Inc.",
"Url": "http://www.namecheap.com"
},
"UpdatedDate": "2019-05-14T16:14:12.000Z"
}
}
}
Human Readable Output
Admin account
| Name | Phone | |
|---|---|---|
| 5be9245893ff486d98c3640879bb2657.protect@whoisguard.com | WhoisGuard Protected | +507.8365503 |
Name servers
| Name |
|---|
| pns31.cloudns.net |
| pns32.cloudns.net |
| pns33.cloudns.net |
| pns34.cloudns.net |
Registrant
| Name | Phone | |
|---|---|---|
| 5be9245893ff486d98c3640879bb2657.protect@whoisguard.com | WhoisGuard Protected | +507.8365503 |
Registrar
| Id | Name | Url |
|---|---|---|
| 1068 | NameCheap, Inc. | http://www.namecheap.com |
Others
| CreationDate | DomainStatus | ExpirationDate | UpdatedDate |
|---|---|---|---|
| 2015-01-16T21:36:27.000Z | registered | 2026-01-16T21:36:27.000Z | 2019-05-14T16:14:12.000Z |
Troubleshooting
The JsonWhoIs API is not stable. We recommend attempting a query three times before considering the query to fail.
Configuration parameters
credentials—token— API Tokenproxy— Use system proxy settingsinsecure— Trust any certificate (not secure)
Commands (1)
-
whoisProvides data enrichment for domains, URLs, and IP addresses.
import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 import urllib3 from CommonServerUserPython import * # Disable insecure warnings urllib3.disable_warnings() """ GLOBALS/PARAMS """ # Parameters received from the user PARAMS = demisto.params() # TOKEN TOKEN = PARAMS.get("credentials", {}).get("password") or PARAMS.get("token") # Service base URL BASE_URL = "https://jsonwhois.com" # Headers to be sent in requests HEADERS = {"Accept": "application/json", "Authorization": f"Token token={TOKEN}"} # Self signed certificate so no need to verify by default USE_SSL = not PARAMS.get("insecure", False) """ HELPER FUNCTIONS """ @logger def http_request(method, url_suffix, params=None, max_retry=3): for _ in range(max_retry): res = requests.request(method, urljoin(BASE_URL, url_suffix), verify=USE_SSL, params=params, headers=HEADERS) if res.status_code == 200: break else: if "res" in locals(): raise DemistoException(f"Error enrich url with JsonWhoIS API. Status code: {res.status_code}") else: raise DemistoException("Error enrich url with JsonWhoIS API.") if res is None: raise DemistoException("Error from JsonWhoIs: Could not get a result from the API.") try: raw = res.json() except ValueError: raise DemistoException(f"Error from JsonWhoIs: Could not parse JSON from response. {res.text}") if "error" in raw: raise DemistoException(f'Error from JsonWhoIs: {raw["error"]}') return raw def dict_by_ec(cur_dict: dict): """Create dict (Json) by entry contexts convention Capitalize first char, remove nulls :param cur_dict: dictionary :return: dictionary by conventions """ if not cur_dict: return None return {key.capitalize(): value for key, value in cur_dict.items() if cur_dict[key]} def list_by_ec(cur_list: list, needed_keys: list): """Create list of dict (Json) by entry contexts convention Capitalize first char in dict, remove nulls, remove not needed parameters :param cur_list: list of dict :param needed_keys: key to save :return: modified list by description above """ if not cur_list: return None cur_list = [createContext(index, removeNull=True) for index in cur_list] def cur_ec(index_ec): return {key.capitalize(): index_ec[key] for key in index_ec if key in needed_keys} cur_list = [cur_ec(contact) for contact in cur_list] return cur_list """ COMMANDS + REQUESTS FUNCTIONS """ @logger def whois(url: str) -> tuple: """Get Rest API raw from JsonWhoIs API :param url: url to query :return: raw response and entry context """ # Perform request params = {"domain": url} raw = http_request(method="GET", url_suffix="/api/v1/whois", params=params) # Build all ec ec = { "DomainStatus": raw.get("status"), "NameServers": list_by_ec(raw.get("nameservers"), needed_keys=["name"]), "CreationDate": raw.get("created_on"), "UpdatedDate": raw.get("updated_on"), "ExpirationDate": raw.get("expires_on"), "Registrar": dict_by_ec(raw.get("registrar")), "Registrant": list_by_ec(raw.get("registrant_contacts"), needed_keys=["name", "phone", "email"]), "Admin": list_by_ec(raw.get("admin_contacts"), needed_keys=["name", "phone", "email"]), } createContext(ec, removeNull=True) return ec, raw @logger def whois_command(): """Whois command""" # Get url arg domain = demisto.args().get("query") # Get parsed entry context and raw data ec, raw = whois(domain) # Create human-readable format human_readable = "" if ec.get("Admin"): human_readable += tableToMarkdown(name="Admin account", t=ec["Admin"]) if ec.get("NameServers"): human_readable += tableToMarkdown(name="Name servers", t=ec["NameServers"]) if ec.get("Registrant"): human_readable += tableToMarkdown(name="Registrant", t=ec["Registrant"]) if ec.get("Registrar"): human_readable += tableToMarkdown(name="Registrar", t=ec["Registrar"]) # Others table others_keys = ["DomainStatus", "CreationDate", "UpdatedDate", "ExpirationDate"] ec_others = {key: ec[key] for key in ec if key in others_keys} human_readable += tableToMarkdown(name="Others", t=ec_others) # Create full ec ec = {"Domain": {"WHOIS": ec}} return_outputs(readable_output=human_readable, outputs=ec, raw_response=raw) @logger def test_module(): whois("whois.com") demisto.results("ok") """ EXECUTION""" def main(): LOG(f"Command being called is {demisto.command()}") handle_proxy() try: if demisto.command() == "whois": whois_command() if demisto.command() == "test-module": test_module() # Log exceptions except Exception as e: return_error(str(e)) # python2 uses __builtin__ python3 uses builtins if __name__ in ("__builtin__", "builtins"): main()