Details

ID	`RDAP`
Provider	Open Source
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`

README

RDAP Integration

Overview

The RDAP (Registration Data Access Protocol) integration allows you to query domain and IP information using the RDAP protocol. This integration provides valuable data for threat intelligence and domain/IP enrichment purposes.

Configuration

Navigate to Settings > Integrations > Servers & Services.
Search for RDAP.
Click Add instance to create and configure a new integration instance.
Configure the instance name and reliability.
Click Test to validate the configuration.

Commands

ip

This command queries IP information using RDAP.

Input

Argument Name	Description	Required
ip	An IPv4 address to query, e.g., 1.1.1.1.	Required

Example Command

!ip ip=8.8.8.8

Context Output

Path	Type	Description
IP.Address	String	The IP address.
IP.Description	String	The IP address description.
IP.Geo.Country	String	The IP address geo country.
IP.Organization.Name	String	The IP address organization name.
IP.Registrar.Abuse.Address	String	The address of the abuse Team.
IP.Registrar.Abuse.Email	String	The email address of the abuse team.
IP.Registrar.Abuse.Name	String	The name of the abuse team.
RDAP.IP.Value	String	The queried IP address.
RDAP.IP.IndicatorType	String	The type of the indicator (IP).
RDAP.IP.RegistrarAbuseAddress	String	The registrar abuse address for the IP.
RDAP.IP.RegistrarAbuseName	String	The registrar abuse contact name for the IP.
RDAP.IP.RegistrarAbuseEmail	String	The registrar abuse email for the IP.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.

domain

This command queries domain information using RDAP.

Input

Argument Name	Description	Required
domain	A domain address to query, e.g., example.com.	Required

Example Command

!domain domain=example.com

Context Output

Path	Type	Description
Domain.Name	String	The domain name.
Domain.CreationDate	Date	The domain registration date.
Domain.ExpirationDate	Date	The domain expiration date.
Domain.WHOIS.CreationDate	Date	The domain registration date.
Domain.WHOIS.ExpirationDate	Date	The domain expiration date.
RDAP.Domain.Value	String	The queried domain name.
RDAP.Domain.IndicatorType	String	The type of the indicator (Domain).
RDAP.Domain.RegistrationDate	Date	The domain registration date.
RDAP.Domain.ExpirationDate	Date	The domain expiration date.
RDAP.Domain.LastChangedDate	Date	The last changed date of the domain.
RDAP.Domain.SecureDNS	Boolean	Whether the domain uses secure DNS.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.

Additional Information

For more information on RDAP, please visit ICANN’s RDAP page.

Configuration parameters

base_url — BaseURL (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
proxy_url — Proxy URL
integrationReliability — Reliability (required)

Commands (2)

domain
Query domain information using RDAP.
ip
Query IP information using RDAP.

Source

RDAP.py RDAP_test.py RDAP.yml RDAP_description.md

Download History Raw

commonfields:
  id: RDAP
  version: -1
sectionorder:
- Connect
- Collect
name: RDAP
display: RDAP
category: Data Enrichment & Threat Intelligence
provider: Open Source
description: Use the RDAP integration to query domain and IP information.
configuration:
- display: BaseURL
  name: base_url
  type: 0
  required: true
  additionalinfo: The base URL for the RDAP service.
  defaultvalue: https://rdap.org
  section: Connect
  advanced: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  defaultvalue: 'false'
  required: false
- display: Proxy URL
  additionalinfo: "Supports socks4/socks5/http connect proxies (e.g., socks5h://host:1080)."
  name: proxy_url
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Reliability
  name: integrationReliability
  type: 15
  required: true
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  defaultvalue: A - Completely reliable
  additionalinfo: Reliability of the source providing the intelligence data.
  section: Collect
script:
  script: ''
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  commands:
  - name: ip
    arguments:
    - name: ip
      required: true
      description: IP address to query.
      isArray: true
      default: true
    outputs:
    - contextPath: IP.Address
      description: The IP address.
    - contextPath: IP.Description
      description: The IP address description.
    - contextPath: IP.Geo.Country
      description: The IP address geo country.
    - contextPath: IP.Organization.Name
      description: The IP address organization name.
    - contextPath: IP.Registrar.Abuse.Address
      description: The address of the abuse team.
    - contextPath: IP.Registrar.Abuse.Email
      description: The email address of the abuse team.
    - contextPath: IP.Registrar.Abuse.Name
      description: The name of the abuse team.
    - contextPath: RDAP.IP.Value
      description: The queried IP address.
    - contextPath: RDAP.IP.IndicatorType
      description: The type of the indicator (IP).
    - contextPath: RDAP.IP.RegistrarAbuseAddress
      description: The registrar abuse address for the IP.
    - contextPath: RDAP.IP.RegistrarAbuseName
      description: The registrar abuse contact name for the IP.
    - contextPath: RDAP.IP.RegistrarAbuseEmail
      description: The registrar abuse email for the IP.
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
    - contextPath: DBotScore.Type
      description: The indicator type.
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
    - contextPath: DBotScore.Score
      description: The actual score.
    description: Query IP information using RDAP.
  - name: domain
    arguments:
    - name: domain
      required: true
      description: Domain to query.
      isArray: true
    outputs:
    - contextPath: Domain.Name
      description: The domain name.
    - contextPath: Domain.CreationDate
      description: The domain registration date.
    - contextPath: Domain.ExpirationDate
      description: The domain expiration date.
    - contextPath: Domain.WHOIS.CreationDate
      description: The domain registration date.
    - contextPath: Domain.WHOIS.ExpirationDate
      description: The domain expiration date.
    - contextPath: RDAP.Domain.Value
      description: The queried domain name.
    - contextPath: RDAP.Domain.IndicatorType
      description: The type of the indicator (Domain).
    - contextPath: RDAP.Domain.RegistrationDate
      description: The domain registration date.
    - contextPath: RDAP.Domain.ExpirationDate
      description: The domain expiration date.
    - contextPath: RDAP.Domain.LastChangedDate
      description: The last changed date of the domain.
    - contextPath: RDAP.Domain.SecureDNS
      description: Whether the domain uses secure DNS.
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
    - contextPath: DBotScore.Type
      description: The indicator type.
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
    - contextPath: DBotScore.Score
      description: The actual score.
    description: Query domain information using RDAP.

tests:
- No tests
fromversion: 6.10.0