PassiveTotal (v2.1.24)
Analyze and understand threat infrastructure from a variety of sources–passive DNS, active DNS, WHOIS, SSL certificates and more–without devoting resources to time-intensive manual threat research and analysis
- Author
- RiskIQ
- Support
- community
- URL
- https://www.riskiq.com/resources/support/
- Categories
- Data Enrichment & Threat Intelligence
Indicator types (1)
- RiskIQSerialNumber
Integrations (2)
- PassiveTotal (Deprecated)
- PassiveTotal v2
Layouts (5)
- PassiveTotal Domain Indicator Layout
- PassiveTotal Email Indicator Layout
- PassiveTotal File SHA-1 Indicator
- PassiveTotal IP Indicator Layout
- RiskIQSerialNumber Indicator
Scripts (17)
- PTEnrich
- RiskIQPassiveTotalComponentsScript
- RiskIQPassiveTotalComponentsWidgetScript
- RiskIQPassiveTotalHostPairChildrenScript
- RiskIQPassiveTotalHostPairParentsScript
- RiskIQPassiveTotalHostPairsChildrenWidgetScript
- RiskIQPassiveTotalHostPairsParentsWidgetScript
- RiskIQPassiveTotalPDNSScript
- RiskIQPassiveTotalPDNSWidgetScript
- RiskIQPassiveTotalSSLForIssuerEmailWidgetScript
- RiskIQPassiveTotalSSLForSubjectEmailWidgetScript
- RiskIQPassiveTotalSSLScript
- RiskIQPassiveTotalSSLWidgetScript
- RiskIQPassiveTotalTrackersScript
- RiskIQPassiveTotalTrackersWidgetScript
- RiskIQPassiveTotalWhoisScript
- RiskIQPassiveTotalWhoisWidgetScript
README
RiskIQ PassiveTotal provides access to the most comprehensive internet data sets available to protect organizations from modern cybersecurity threats. The platform maps and exposes threat infrastructure and provides unparalleled context and intelligence to events and incidents.
What does this pack do?
The content pack PassiveTotal provides the following capabilities:
- Returns the DomainWhois record for the registered domain name portion of the hostname.
- Search all tracker addresses and host information.
- Active account sources can be used to retrieve passive DNS results.
- Retrieves the SSL certificate history.
- Returns the exposed services that are relevant to the query.
- Delivers insights into adversary threat infrastructure organized around a set of purpose-built intelligence profiles.
- Provides dynamic reputation scoring on IPs and domains.
- Delivers prioritized insights on an organization’s attack surface, including impacted assets (observations).
- The practical picture of vulnerability risk, focused on a specific Attack Surface (your own or a third-party vendor).