JsonWhoIs

Details

ID	`JsonWhoIs`
Provider	JsonWhois
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Use the JsonWhoIs integration to enrich domain indicators.

Configure JsonWhoIs in Cortex

Parameter	Description	Example
Name	A meaningful name for the integration instance.	JsonWhoIs_instance_1
API Token	Your JsonWhoIs API token	N/A
System proxy	Runs the integration instance using the proxy server (HTTP or HTTPS) that you defined in the server configuration.	https://proxyserver.com
Trust any certificate (not secure)	When selected, certificates are not checked.	N/A
Do Not Use by Default	If checked the commands will not be used by default (this is influenced if two command are the same).	N/A

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Get enriched data

Returns enriched data for Domains, URLs, and IP addresses.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

whois

Input

Argument Name	Description	Required
query	The URL, IP address, or domain to enrich.	Required

Context Output

Path	Type	Description
Domain.WHOIS.DomainStatus	Boolean	Whether the domain is registered.
Domain.WHOIS.NameServers	String	The name servers.
Domain.WHOIS.CreationDate	Date	The creation date.
Domain.WHOIS.UpdatedDate	Date	The updated date.
Domain.WHOIS.ExpirationDate	Date	The expiration date.
Domain.WHOIS.Registrant.Name	String	The registrant name.
Domain.WHOIS.Registrant.Email	String	The registrant email.
Domain.WHOIS.Registrant.Phone	String	The registrant phone.
Domain.WHOIS.Registrar.Name	String	The registrar name.
Domain.WHOIS.Registrar.Url	String	The registrar email.
Domain.WHOIS.Registrar.Organization	String	The registrar organization name.
Domain.WHOIS.Registrar.Id	Number	The registrar ID.
Domain.WHOIS.Admin.Name	String	The Admin name.
Domain.WHOIS.Admin.Email	String	The Admin email.
Domain.WHOIS.Admin.Phone	String	The Admin phone.

Command Example

!whois query=demisto.com

Context Example

{
    "Domain": {
        "WHOIS": {
            "Admin": [
                {
                    "Email": "5be9245893ff486d98c3640879bb2657.protect@whoisguard.com",
                    "Name": "WhoisGuard Protected",
                    "Phone": "+507.8365503"
                }
            ],
            "CreationDate": "2015-01-16T21:36:27.000Z",
            "DomainStatus": "registered",
            "ExpirationDate": "2026-01-16T21:36:27.000Z",
            "NameServers": [
                {
                    "Name": "pns31.cloudns.net"
                },
                {
                    "Name": "pns32.cloudns.net"
                },
                {
                    "Name": "pns33.cloudns.net"
                },
                {
                    "Name": "pns34.cloudns.net"
                }
            ],
            "Registrant": [
                {
                    "Email": "5be9245893ff486d98c3640879bb2657.protect@whoisguard.com",
                    "Name": "WhoisGuard Protected",
                    "Phone": "+507.8365503"
                }
            ],
            "Registrar": {
                "Id": "1068",
                "Name": "NameCheap, Inc.",
                "Url": "http://www.namecheap.com"
            },
            "UpdatedDate": "2019-05-14T16:14:12.000Z"
        }
    }
}

Human Readable Output

Admin account

Email	Name	Phone
5be9245893ff486d98c3640879bb2657.protect@whoisguard.com	WhoisGuard Protected	+507.8365503

Name servers

Name
pns31.cloudns.net
pns32.cloudns.net
pns33.cloudns.net
pns34.cloudns.net

Registrant

Email	Name	Phone
5be9245893ff486d98c3640879bb2657.protect@whoisguard.com	WhoisGuard Protected	+507.8365503

Registrar

Id	Name	Url
1068	NameCheap, Inc.	http://www.namecheap.com

Others

CreationDate	DomainStatus	ExpirationDate	UpdatedDate
2015-01-16T21:36:27.000Z	registered	2026-01-16T21:36:27.000Z	2019-05-14T16:14:12.000Z

Troubleshooting

The JsonWhoIs API is not stable. We recommend attempting a query three times before considering the query to fail.

Configuration parameters

credentials —
token — API Token
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)

Commands (1)

whois
Provides data enrichment for domains, URLs, and IP addresses.

Source

JsonWhoIs.py JsonWhoIs_test.py JsonWhoIs.yml JsonWhoIs_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: JsonWhois
sectionorder:
- Connect
- Collect
commonfields:
  id: JsonWhoIs
  version: -1
configuration:
- name: credentials
  type: 9
  displaypassword: API Token
  hiddenusername: true
  section: Connect
  required: false
- display: API Token
  name: token
  type: 4
  hidden: true
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
description: Provides data enrichment for domains and IP addresses.
display: JsonWhoIs
name: JsonWhoIs
script:
  commands:
  - arguments:
    - default: true
      description: URL, IP, or domain to enrich.
      name: query
      required: true
    description: Provides data enrichment for domains, URLs, and IP addresses.
    name: whois
    outputs:
    - contextPath: Domain.WHOIS.DomainStatus
      description: The status of the domain.
      type: Boolean
    - contextPath: Domain.WHOIS.NameServers
      description: Name servers.
      type: String
    - contextPath: Domain.WHOIS.CreationDate
      description: Creation of the domain.
      type: Date
    - contextPath: Domain.WHOIS.UpdatedDate
      description: Date that the domain was last updated.
      type: Date
    - contextPath: Domain.WHOIS.ExpirationDate
      description: Expiration date of the domain.
      type: Date
    - contextPath: Domain.WHOIS.Registrant.Name
      description: Registrant name.
      type: String
    - contextPath: Domain.WHOIS.Registrant.Email
      description: Registrant email address.
      type: String
    - contextPath: Domain.WHOIS.Registrant.Phone
      description: Registrant phone number.
      type: String
    - contextPath: Domain.WHOIS.Registrar.Name
      description: Registrar name.
      type: String
    - contextPath: Domain.WHOIS.Registrar.Url
      description: Registrar email address.
      type: String
    - contextPath: Domain.WHOIS.Registrar.Organization
      description: Registrar organization name.
      type: String
    - contextPath: Domain.WHOIS.Registrar.Id
      description: Registrar ID.
      type: Number
    - contextPath: Domain.WHOIS.Admin.Name
      description: Admin name.
      type: String
    - contextPath: Domain.WHOIS.Admin.Email
      description: Admin email address.
      type: String
    - contextPath: Domain.WHOIS.Admin.Phone
      description: Admin phone number.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  type: python
  subtype: python3
tests:
- JsonWhoIs-Test
fromversion: 5.0.0