Roksit DNS Security

Details

ID	`Roksit DNS Security`
Provider	Roksit
Category	Network Security
From Version	6.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

This integration provides adding selected domains to the Roksit Secure DNS’s Blacklisted Domain List through API .
This integration was integrated and tested with version 1.0.0 of Roksit DNS Security (DNSSense).

Configure Roksit DNS Security (DNSSense) in Cortex

Parameter	Required
Server URL (e.g. https://portal.roksit.com/api/integration/blacklist)	True
API Key	True
Trust any certificate (not secure)	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Roksit-add-to-blacklist

This command adds a given domain to tha Roksit blacklist.

Base Command

Roksit-add-to-blacklist

Input

Argument Name	Description	Required
Domain	The Domain to send to the blacklist.	Required

Context Output

There is no context output for this command.

Command example

!Roksit-add-to-blacklist Domain=dummy.com

Human Readable Output

dummy.com was successfully added to the blacklist.

Configuration parameters

url — Server URL (e.g. https://portal.roksit.com/api/integration/blacklist) (required)
credentials — (required)
insecure — Trust any certificate (not secure)

Commands (1)

Roksit-add-to-blacklist
This command adds a given domain to tha Roksit blacklist.

Source

RoksitDNSSecurity.py RoksitDNSSecurity.yml RoksitDNSSecurity_description.md command_examples.txt

Download History Raw

import demistomock as demisto  # noqa: F401
import requests
from CommonServerPython import *  # noqa: F401


def send_to_roksit_blacklist(url, yourkey, domain):
    headers = {"Content-Type": "application/json", "ApiKey": yourkey}

    blacklist = {"items": [domain]}
    x = requests.post(url, headers=headers, json=blacklist)
    if x.status_code == 200:
        return CommandResults(readable_output=f"{domain} was successfully added to the blacklist.")
    else:
        raise DemistoException(message="Failed to add domain to blacklist")


def main():
    try:
        params = demisto.params()
        command = demisto.command()
        url = params.get("url", "https://portal.roksit.com/api/integration/blacklist")
        yourkey = params.get("credentials", {}).get("password")
        domain = demisto.args().get("Domain")

        if command == "test-module":
            # send a period as a dummy domain to check connectivity
            send_to_roksit_blacklist(url, yourkey, ".")
            return_results("ok")
        elif command == "Roksit-add-to-blacklist":
            return_results(send_to_roksit_blacklist(url, yourkey, domain))
    except DemistoException as e:
        return_error(f"Failed to execute {command} command. Error: {e!s}.")


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()