SilentPush

The Silent Push Platform uses first-party data and a proprietary scanning engine to enrich global DNS data with risk and reputation scoring, giving security teams the ability to join the dots across the entire IPv4 and IPv6 range, and identify adversary infrastructure before an attack is launched. The content pack integrates with the Silent Push system to gain insights into domain/IP information, reputations, enrichment, and infratag-related details. It also provides functionality to live-scan URLs and take screenshots of them. Additionally, it allows fetching future attack feeds from the Silent Push system.
This integration was integrated and tested with version 4.2 of SilentPush.

Configure SilentPush in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

silentpush-density-lookup

This command queries granular DNS/IP parameters (e.g., NS servers, MX servers, IPaddresses, ASNs) for density information.

Base Command

silentpush-density-lookup

Input

Context Output

Command example

!silentpush-density-lookup qtype="nssrv" query="vida.ns.cloudflare.com"

Context Example

{
 "qtype": "nssrv",
 "query": "vida.ns.cloudflare.com",
 "records": [
  {
   "density": 100601,
   "nssrv": "vida.ns.cloudflare.com"
  }
 ]
}

Human Readable Output

Results

Field	Value
Density	100601
NSSRV	vida.ns.cloudflare.com

silentpush-forward-padns-lookup

This command performs a forward PADNS lookup using various filtering parameters.

Base Command

silentpush-forward-padns-lookup

Input

Context Output

Command Example

!silentpush-forward-padns-lookup qtype="ns" qname="silentpush.com"

Context Example

{
 "qtype": "ns",
 "qname": "silentpush.com",
 "records": [
  {
   "answer": "henry.ns.cloudflare.com",
   "count": 23043,
   "first_seen": "2020-12-24 19:04:43",
   "last_seen": "2025-04-08 07:06:24",
   "nshash": "850c47a684c9ea9c32ece18e7be4cddc",
   "query": "silentpush.com"
  }
 ]
}

Human Readable Output

Results

Field	Value
Answer	henry.ns.cloudflare.com
Count	23043
First Seen	2020-12-24 19:04:43
Last Seen	2025-04-08 07:06:24
NSHash	850c47a684c9ea9c32ece18e7be4cddc
Query	silentpush.com

silentpush-get-asn-reputation

This command retrieve the reputation information for an IPv4.

Base Command

silentpush-get-asn-reputation

Input

Context Output

Command Example

!silentpush-get-asn-reputation asn="12345"

Context Example

{
 "asn": "12345",
 "reputation": 0,
 "as_name": "AS12345, IT",
 "date": "20250408"
}

Human Readable Output

Results

Field	Value
ASN	12345
Reputation	0
AS Name	AS12345, IT
Date	2025-04-08

silentpush-get-asn-takedown-reputation

This command retrieve the takedown reputation information for an Autonomous System Number (ASN).

Base Command

silentpush-get-asn-takedown-reputation

Input

Context Output

Command Example

!silentpush-get-asn-takedown-reputation asn="211298"

Context Example

{
 "asn": "211298",
 "asn_allocation_age": 1420,
 "asn_allocation_date": "2021-05-19",
 "asn_takedown_reputation": 0,
 "as_name": "INTERNET-MEASUREMENT, GB"
}

Human Readable Output

Results

Field	Value
ASN	211298
ASN Allocation Age	1420 days
ASN Allocation Date	2021-05-19
ASN Takedown Reputation	0
AS Name	INTERNET-MEASUREMENT, GB

silentpush-get-asns-for-domain

This command retrieves Autonomous System Numbers (ASNs) associated with a domain.

Base Command

silentpush-get-asns-for-domain

Input

Context Output

Command Example

!silentpush-get-asns-for-domain domain="silentpush.com"

Context Example

{
 "domain": "silentpush.com",
 "asns": [
  {
   "asn": "13335",
   "description": "CLOUDFLARENET, US"
  },
  {
   "asn": "14618",
   "description": "AMAZON-AES, US"
  },
  {
   "asn": "16509",
   "description": "AMAZON-02, US"
  },
  {
   "asn": "209242",
   "description": "CLOUDFLARESPECTRUM Cloudflare, Inc., US"
  },
  {
   "asn": "213230",
   "description": "HETZNER-CLOUD2-AS, DE"
  },
  {
   "asn": "24940",
   "description": "HETZNER-AS, DE"
  }
 ]
}

Human Readable Output

Results

ASN	Description
13335	CLOUDFLARENET, US
14618	AMAZON-AES, US
16509	AMAZON-02, US
209242	CLOUDFLARESPECTRUM Cloudflare, Inc., US
213230	HETZNER-CLOUD2-AS, DE
24940	HETZNER-AS, DE

silentpush-get-domain-certificates

This command get certificate data collected from domain scanning.

Base Command

silentpush-get-domain-certificates

Input

Context Output

Command Example

!silentpush-get-domain-certificates domain="silentpush.com"

Context Example

{
 "domain": "silentpush.com",
 "certificates": [
  {
   "common_name": "silentpush.com",
   "expires_on": "2025-07-03 16:02:40",
   "fingerprint_sha256": "f7ec9de47a7b22181e6a394a2af8a59793c6ea07538fc49a2351b25c6dc20d69",
   "issued_on": "2025-04-04 16:02:41",
   "issuer": "E5",
   "serial_number": "6E51EEDAA93109DCA31CE852A8D0C27C001",
   "subject_alternative_names": ["silentpush.com"]
  }
 ]
}

Human Readable Output

Result

Field	Value
Common Name	silentpush.com
Expires On	2025-07-03 16:02:40
Fingerprint (SHA256)	f7ec9de47a7b22181e6a394a2af8a59793c6ea07538fc49a2351b25c6dc20d69
Issued On	2025-04-04 16:02:41
Issuer	E5
Serial Number	6E51EEDAA93109DCA31CE852A8D0C27C001
Subject Alternative Names	silentpush.com

silentpush-get-enrichment-data

This command retrieves comprehensive enrichment information for a given resource (domain, IPv4, or IPv6).

Base Command

silentpush-get-enrichment-data

Input

Context Output

Command Example

!silentpush-get-enrichment-data resource="ipv4" value="0.0.0.0"

Context Example

{
 "resource": "ipv4",
 "value": "0.0.0.0",
 "enrichment_data": {
  "asn": "15169",
  "asn_allocation_age": 9140,
  "asn_allocation_date": "2000-03-30",
  "asn_rank": 0,
  "asn_rank_score": 0,
  "asn_reputation": 0,
  "asn_reputation_score": 0,
  "asn_takedown_reputation": 80,
  "asn_takedown_reputation_score": 80,
  "as_name": "GOOGLE, US",
  "benign_info": {
   "actor": "",
   "known_benign": false
  },
  "tags": [],
  "date": "2025-04-08",
  "density": 0,
  "ip": "0.0.0.0",
  "ip_flags": {
   "is_proxy": false,
   "is_sinkhole": false,
   "is_vpn": false
  },
  "ip_has_expired_certificate": false,
  "ip_has_open_directory": false,
  "ip_is_dsl_dynamic": false,
  "ip_is_dsl_dynamic_score": 0,
  "ip_is_ipfs_node": false
 }
}

Human Readable Output

Result

Field	Value
ASN	15169
ASN Allocation Age	9140 days
ASN Allocation Date	2000-03-30
ASN Rank	0
ASN Rank Score	0
ASN Reputation	0
ASN Reputation Score	0
ASN Takedown Reputation	80
ASN Takedown Reputation Score	80
AS Name	GOOGLE, US
Known Benign	No
Date	2025-04-08
Density	0
IP Flags (Proxy, Sinkhole, VPN)	No, No, No
Expired Certificate	No
Open Directory	No
DSL Dynamic	No
DSL Dynamic Score	0
IPFS Node	No

silentpush-get-future-attack-indicators

This command fetch indicators of potential future attacks using a feed UUID.

Base Command

silentpush-get-future-attack-indicators

Input

Context Output

Command Example

!silentpush-get-future-attack-indicators feed_uuid="99da9b6a-146b-4a4d-9929-5fd5c6e2c257"

Context Example

{
 "feed_uuid": "99da9b6a-146b-4a4d-9929-5fd5c6e2c257",
 "future_attack_indicators": {
  "total_source_score": 100,
  "total_ioc": 100,
  "total_custom": 0,
  "total": 100,
  "name": "capital-gainers.com",
  "uuid": "560ee6da03f56cec",
  "ioc_uuid": "f2556a5a18607c70",
  "type": "domain",
  "ioc_template": "domain",
  "last_seen_on": "2025-04-08T01:24:57",
  "source_uuid": "99da9b6a-146b-4a4d-9929-5fd5c6e2c257",
  "source_name": "AI Generated Investment/Banks Domains",
  "source_vendor_name": "Silent Push",
  "first_seen_on": "2025-04-07T07:24:36"
 }
}

Human Readable Output

Result

Field	Value
Feed Name	capital-gainers.com
Feed UUID	560ee6da03f56cec
IOC UUID	f2556a5a18607c70
Type	Domain
IOC Template	Domain
Source UUID	99da9b6a-146b-4a4d-9929-5fd5c6e2c257
Source Name	AI Generated Investment/Banks Domains
Source Vendor Name	Silent Push
First Seen	2025-04-07T07:24:36
Last Seen	2025-04-08T01:24:57
Total Source Score	100
Total IOCs	100
Total Custom IOCs	0
Total IOCs Reported	100

silentpush-get-ipv4-reputation

This command retrieve the reputation information for an IPv4.

Base Command

silentpush-get-ipv4-reputation

Input

Context Output

Command Example

!silentpush-get-nameserver-reputation nameserver="a.dns-servers.net.ru" limit="5"

Context Example

{
 "nameserver": "a.dns-servers.net.ru",
 "limit": 5,
 "nameserver_reputation_data": {
  "date": "2025-04-05",
  "ns_server": "a.dns-servers.net.ru",
  "ns_server_reputation": 0
 }
}

Human Readable Output

Result

Field	Value
Nameserver	a.dns-servers.net.ru
Date	2025-04-05
Nameserver Reputation	0

silentpush-get-job-status

This command retrieve status of running job or results from completed job.

Base Command

silentpush-get-job-status

Input

Context Output

Command Example

!silentpush-get-job-status job_id="d4067541-eafb-424c-98d3-de12d7a91331"

Context Example

{
 "job_id": "d4067541-eafb-424c-98d3-de12d7a91331",
 "job_status": {
  "job_id": "d4067541-eafb-424c-98d3-de12d7a91331",
  "status": "PENDING"
 }
}

Human Readable Output

Result

Field	Value
Job ID	d4067541-eafb-424c-98d3-de12d7a91331
Status	PENDING

silentpush-get-nameserver-reputation

This command retrieve historical reputation data for a specified nameserver, including reputation scores and optional detailed calculation information.

Base Command

silentpush-get-nameserver-reputation

Input

Context Output

Command Example

!silentpush-get-nameserver-reputation nameserver="a.dns-servers.net.ru" limit="5"

Context Example

{
 "nameserver": "a.dns-servers.net.ru",
 "limit": 5,
 "nameserver_reputation_data": {
  "date": "2025-04-05",
  "ns_server": "a.dns-servers.net.ru",
  "ns_server_reputation": 0
 }
}

Human Readable Output

Result

Field	Value
Nameserver	a.dns-servers.net.ru
Date	2025-04-05
Nameserver Reputation	0

silentpush-get-subnet-reputation

This command retrieves the reputation history for a specific subnet.

Base Command

silentpush-get-subnet-reputation

Input

Context Output

Command Example

!silentpush-get-subnet-reputation subnet="192.168.0.0/16"

Context Example

{
 "subnet": "192.168.0.0/16",
 "subnet_reputation_data": {
  "date": "2025-04-08",
  "subnet": "192.168.0.0/16",
  "subnet_reputation": 0
 }
}

Human Readable Output

Result

Field	Value
Subnet	192.168.0.0/16
Date	2025-04-08
Subnet Reputation	0

silentpush-list-domain-information

This command get domain information along with Silent Push risk score and live whois information for multiple domains.

Base Command

silentpush-list-domain-information

Input

Context Output

Command Example

!silentpush-list-domain-information domains="silentpush.com"

Context Example

{
 "domains": ["silentpush.com"],
 "domain_information": {
  "domain": "silentpush.com",
  "age": 1904,
  "age_score": 0,
  "first_seen": "2020-01-21",
  "is_new": false,
  "is_new_score": 0,
  "last_seen": "2025-04-08",
  "registrar": "ENOM, INC.",
  "whois_age": 1904,
  "whois_created_date": "2020-01-20 08:14:27",
  "zone": "com"
 }
}

Human Readable Output

Results

Field	Value
Domain	silentpush.com
Age	1904 years
Age Score	0
First Seen	2020-01-21
Is New	No
Is New Score	0
Last Seen	2025-04-08
Registrar	ENOM, INC.
WHOIS Age	1904 years
WHOIS Created Date	2020-01-20 08:14:27
Zone	com

silentpush-list-domain-infratags

This command get infratags for multiple domains with optional clustering.

Base Command

silentpush-list-domain-infratags

Input

Context Output

Command Example

!silentpush-list-domain-infratags domains="silentpush.com" mode="live" match="self" as_of="self"

Context Example

{
 "domains": ["silentpush.com"],
 "mode": "live",
 "match": "self",
 "as_of": "self",
 "infratags": {
  "domain": "silentpush.com",
  "mode": "padns",
  "tags": ["outlook.com", "cloudflare.com", "cloudflarenet", "enom"]
 }
}

Human Readable Output

Results

Field	Value
Domain	silentpush.com
Mode	padns
Tags	outlook.com, cloudflare.com, cloudflarenet, enom

silentpush-list-ip-information

This command get IP information for multiple IPv4s and IPv6s.

Base Command

silentpush-list-ip-information

Input

Context Output

Command Example

!silentpush-list-ip-information ips="0.0.0.0"

Context Example

{
 "ips": ["0.0.0.0"],
 "ip_information": {
  "asn": "15169",
  "asn_allocation_age": 9140,
  "asn_allocation_date": "2000-03-30",
  "asn_rank": 0,
  "asn_rank_score": 0,
  "asn_reputation": 0,
  "asn_reputation_score": 0,
  "asn_takedown_reputation": 10,
  "asn_takedown_reputation_explain": "ips_active: 327064, ips_in_asn: 15309568, ips_num_listed: 5",
  "asn_takedown_reputation_score": 10,
  "as_name": "GOOGLE, US",
  "benign_info": {
   "actor": "",
   "known_benign": false
  },
  "tags": [],
  "date": "2025-04-08",
  "density": 0,
  "ip": "0.0.0.0",
  "ip_flags": {
   "is_proxy": false,
   "is_sinkhole": false,
   "is_vpn": false
  },
  "ip_has_expired_certificate": false,
  "ip_has_open_directory": false,
  "ip_is_dsl_dynamic": false,
  "ip_is_dsl_dynamic_score": 0
 }
}

Human Readable Output

Results

Field	Value
ASN	15169
ASN Allocation Age	9140 days
ASN Allocation Date	2000-03-30
ASN Rank	0
ASN Rank Score	0
ASN Reputation	0
ASN Reputation Score	0
ASN Takedown Reputation	10
Takedown Explanation	ips_active: 327064, ips_in_asn: 15309568, ips_num_listed: 5
ASN Takedown Reputation Score	10
AS Name	GOOGLE, US
Known Benign	No
Date	2025-04-08
Density	0
IP Flags (Proxy, Sinkhole, VPN)	No, No, No
Expired Certificate	No
Open Directory	No
DSL Dynamic	No
DSL Dynamic Score	0

silentpush-live-url-scan

This command scan a URL to retrieve hosting metadata..

Base Command

silentpush-live-url-scan

Input

Context Output

Command Example

!silentpush-live-url-scan url="https://example.com"

Context Example

{
 "url": "https://example.com",
 "scan_results": {
  "status": "No scan results found",
  "url": "https://example.com"
 }
}

Human Readable Output

Results

Field	Value
URL	https://example.com
Scan Status	No scan results found

silentpush-reverse-padns-lookup

This command retrieve reverse Passive DNS data for specific DNS record types.

Base Command

silentpush-reverse-padns-lookup

Input

Context Output

Command Example

!silentpush-reverse-padns-lookup qtype="ns" qname="vida.ns.cloudflare.com"

Context Example

{
 "qtype": "ns",
 "qname": "vida.ns.cloudflare.com",
 "reverse_padns_lookup": {
  "answer": "vida.ns.cloudflare.com",
  "count": 541,
  "first_seen": "2023-10-25 18:46:27",
  "last_seen": "2025-04-08 09:37:41",
  "nshash": "9448b4ad541f0e539d2f5ad271d6d581",
  "query": "ernestchadwick.com"
 }
}

Human Readable Output

Results

Field	Value
Answer	vida.ns.cloudflare.com
Query Count	541
First Seen	2023-10-25 18:46:27
Last Seen	2025-04-08 09:37:41
NS Hash	9448b4ad541f0e539d2f5ad271d6d581
Query Domain	ernestchadwick.com

silentpush-screenshot-url

This commandGenerate screenshot of a URL.

Base Command

silentpush-screenshot-url

Input

Context Output

Command Example

!silentpush-screenshot-url url="https://www.virustotal.com/gui/domain/tbibank-bg.com"

Context Example

{
 "url": "https://www.virustotal.com/gui/domain/tbibank-bg.com",
 "screenshot_data": {
  "status": "Success",
  "screenshot_url": "https://fs.silentpush.com/screenshots/virustotal.com/f2fa9440ee769ad6f6702529c006522b.jpg",
  "file_name": "www.virustotal.com_screenshot.jpg"
 }
}

Human Readable Output

Results

Field	Value
URL	https://www.virustotal.com/gui/domain/tbibank-bg.com
Status	Success
Screenshot URL	View Screenshot
File Name	www.virustotal.com_screenshot.jpg

silentpush-search-domains

This command search for domains with optional filters.

Base Command

silentpush-search-domains

Input

Context Output

Command Example

!silentpush-search-domains

Context Example

{
 "domain_search_results": [
  {
   "asn_diversity": 1,
   "host": "0-------------------------------------------------------------0.com",
   "ip_diversity_all": 1,
   "ip_diversity_groups": 1
  }
 ]
}

Human Readable Output

Results

Field	Value
ASN Diversity	1
Host	0————————————————————-0.com
IP Diversity (All)	1
IP Diversity Groups	1

silentpush-search-scan-data

This command search Silent Push scan data repositories using SPQL queries.

Base Command

silentpush-search-scan-data

Input

Context Output

Command Example

!silentpush-search-scan-data query="tld=cool" limit="5"

Context Example

{
 "query": "tld=cool",
 "limit": 5,
 "scan_data": [
  {
   "domain": "volunteering.cool",
   "ip": "0.0.0.0",
   "asn": "16509",
   "asn_org": "AMAZON-02",
   "city": "Boardman",
   "country": "United States",
   "region": "Oregon",
   "latitude": 45.8401,
   "longitude": -119.705,
   "timezone": "America/Los_Angeles",
   "server": "openresty",
   "ssl": "http",
   "favicon": "http://example.cool/favicon.ico",
   "user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/0.0.0.0 Safari/537.3",
   "scan_date": "2025-04-08T09:12:45Z",
   "status_code": 200
  }
 ]
}

Human Readable Output

Results

Field	Value
Domain	volunteering.cool
IP Address	0.0.0.0
ASN	16509
ASN Organization	AMAZON-02
City	Boardman
Country	United States
Region	Oregon
Latitude	45.8401
Longitude	-119.705
Timezone	America/Los_Angeles
Server	openresty
SSL/TLS Status	HTTP (No SSL)
Favicon
User Agent	Mozilla/5.0 (Linux x86_64)
Scan Date	2025-04-08T09:12:45Z
HTTP Status Code	200

silentpush-run-threat-check

This command runs the threat check on the specified

Base Command

silentpush-run-threat-check

Input

Context Output

silentpush-add-indicators

This command add indicators to the feed

Base Command

silentpush-add-indicators

Input

Context Output

silentpush-add-feed

This command add the new feed

Base Command

silentpush-add-feed

Input

Context Output

silentpush-add-feed-tags

This command add indicators to the feed

Base Command

silentpush-add-feed-tags

Input

Context Output

silentpush-get-data-exports

This command runs the threat check on the specified

Base Command

silentpush-get-data-exports

Input

Context Output

silentpush-add-indicator-tags

This command updates tags to the indicators

Base Command

silentpush-add-indicator-tags

Input

Context Output