TIM - Process Domain Registrant With Whois

This playbook compares the domain registrant against the Cortex XSOAR list of approved registrants provided in the inputs. A registrant is the company or entity that owns the domain.

Whois · 18 tasks · 4 inputs · 4 outputs

Details

ID	`TIM - Process Domain Registrant With Whois`
From Version	5.5.0
Tasks	18

README

This playbook compares the domain registrant against the Cortex XSOAR list of approved registrants provided in the inputs. A registrant is the company or entity that owns the domain.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

SetAndHandleEmpty
Set
FilterByList

Commands

appendIndicatorField

Playbook Inputs

Name	Description	Default Value	Required
Indicator Query	Indicators matching the indicator query will be used as playbook input		Optional
ApprovedregistrantsListName	The Cortex XSOAR list name that contains the approved registrars. A registrant is the company or entity that owns the domain.		Optional
RegistrantListDelimiter	A one-character string used to delimit fields. This must match the value that you defined in the list separator server configuration. The default value is a comma, however, as registrants might contain the “,” character in their name, Cortex XSOAR recommends that you select a different delimiter.	,	Optional
WhoisResults	This input receives the Whois results from the parent playbook.		Optional

Playbook Outputs

Path	Description	Type
RegistrantDomainNotInList	Domains for which the registrant wasn’t in the list.	string
RegistrantDomainInList	Domains for which the registrant was in the list.	string
DomainsNotResolvedByWhois	Domains which Whois wasn’t able to resolve.	string
DomainsNotProcessed	In case no registrant list was provided all domains will be outputted to this context path.	string

Playbook Image

TIM - Process Domain Registrant With Whois

Inputs

—
ApprovedregistrantsListName — The Cortex XSOAR list name that contains the approved registrars. A registrant is the company or entity that owns the domain.
RegistrantListDelimiter — A one-character string used to delimit fields. This must match the value that you defined in the list separator server configuration. The default value is a comma, however, as registrants might contain the "," character in their name, Cortex XSOAR recommends that you select a different delimiter.
WhoisResults — This input receives the Whois results from the parent playbook.

Outputs

RegistrantDomainNotInList — Domains for which the registrant wasn't in the list.
RegistrantDomainInList — Domains for which the registrant was in the list.
DomainsNotResolvedByWhois — Domains which Whois wasn't able to resolve.
DomainsNotProcessed — In case no registrant list was provided all domains will be outputted to this context path.

Commands used

appendIndicatorField

Flowchart

Source

playbook-TIM_-_Process_Domain_Registrant_With_Whois.yml

Download History Raw

id: TIM - Process Domain Registrant With Whois
version: -1
fromversion: 5.5.0
name: TIM - Process Domain Registrant With Whois
description: This playbook compares the domain registrant against the Cortex XSOAR
  list of approved registrants provided in the inputs. A registrant is the company or entity that owns the
  domain.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 56443fa8-222d-4859-8feb-fd9e7b202053
    type: start
    task:
      id: 56443fa8-222d-4859-8feb-fd9e7b202053
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "25"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 8f996d46-fb1d-4680-88cd-a3d222d5a167
    type: condition
    task:
      id: 8f996d46-fb1d-4680-88cd-a3d222d5a167
      version: -1
      name: Are there query results?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: Results
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 9ac9f838-21c1-4381-8745-6ebcab8da602
    type: title
    task:
      id: 9ac9f838-21c1-4381-8745-6ebcab8da602
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 44b28e9c-3040-4919-8edf-98c2861fabbc
    type: regular
    task:
      id: 44b28e9c-3040-4919-8edf-98c2861fabbc
      version: -1
      name: FilterByList
      description: Checks whether the specified item is in a list. The default list
        is the Cortex XSOAR Indicators Allow list.
      scriptName: FilterByList
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "23"
      - "24"
    scriptarguments:
      delimiter:
        simple: ${inputs.RegistrantListDelimiter}
      ignorecase:
        simple: "yes"
      listname:
        simple: ${inputs.ApprovedregistrantsListName}
      matchexact:
        simple: "yes"
      values:
        simple: ${Results.Whois.Registrant.organization}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -70,
          "y": 480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 50b702d1-0484-4baa-87e7-ce371bc4b0b8
    type: condition
    task:
      id: 50b702d1-0484-4baa-87e7-ce371bc4b0b8
      version: -1
      name: Is there an approved registrants list?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "21"
      "yes":
      - "13"
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.ApprovedregistrantsListName
            iscontext: true
    view: |-
      {
        "position": {
          "x": -60,
          "y": 270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 051e749a-0df6-4aed-8aa1-bbaad5b3f6a5
    type: regular
    task:
      id: 051e749a-0df6-4aed-8aa1-bbaad5b3f6a5
      version: -1
      name: Set domains that couldn't be processed
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: DomainsNotProcessed
      stringify: {}
      value:
        complex:
          root: Results
          accessor: Whois.QueryValue
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 730,
          "y": 1230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: 2a35a5b3-1824-4906-8666-be31cf6651b1
    type: condition
    task:
      id: 2a35a5b3-1824-4906-8666-be31cf6651b1
      version: -1
      name: Are there domains without Whois query results?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "22"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEqualString
          left:
            value:
              simple: Results.Whois.QueryResult
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": -1260,
          "y": 480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: fd92dde4-0bda-406e-8402-2307582a68c6
    type: regular
    task:
      id: fd92dde4-0bda-406e-8402-2307582a68c6
      version: -1
      name: Tag domain with no Whois resolution
      description: Tag indicator with the no_whois_result tag.
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: no_whois_resolution
      indicatorsValues:
        simple: ${DomainsNotResolvedByWhois}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1260,
          "y": 1250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: d619742c-2c27-4a60-8156-e877eba9030d
    type: regular
    task:
      id: d619742c-2c27-4a60-8156-e877eba9030d
      version: -1
      name: Set domains by approved registrants
      description: Domains whose registrant appears in the list defined in the inputs.ApprovedregistrantsListName
        context key are added to ApprovedDomains in context.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: ApprovedRegistrantDomains
      stringify: {}
      value:
        complex:
          root: Results
          filters:
          - - operator: inList
              left:
                value:
                  simple: Results.Whois.Registrant.organization
                iscontext: true
              right:
                value:
                  simple: List.In
                iscontext: true
          accessor: Whois.QueryValue
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -320,
          "y": 1045
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: f7130c8f-83a1-4b6d-89ec-8d6018251e31
    type: regular
    task:
      id: f7130c8f-83a1-4b6d-89ec-8d6018251e31
      version: -1
      name: Set domains by non approved registrants
      description: Checks if the specified value exists in context. If the value exists,
        it will be set in context, otherwise no value will be set in context.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: NonApprovedRegistrantDomains
      stringify: {}
      value:
        complex:
          root: Results
          filters:
          - - operator: inList
              left:
                value:
                  simple: Results.Whois.Registrant.organization
                iscontext: true
              right:
                value:
                  simple: List.NotIn
                iscontext: true
          accessor: Whois.QueryValue
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 240,
          "y": 1220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "21":
    id: "21"
    taskid: bc5363dd-1f51-4e66-89d2-12a52b46dec3
    type: title
    task:
      id: bc5363dd-1f51-4e66-89d2-12a52b46dec3
      version: -1
      name: No registrant list provided
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 730,
          "y": 480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "22":
    id: "22"
    taskid: c17301fa-f768-4889-8bc1-2ab05c94b019
    type: title
    task:
      id: c17301fa-f768-4889-8bc1-2ab05c94b019
      version: -1
      name: Domain not found by Whois
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1260,
          "y": 970
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "23":
    id: "23"
    taskid: 87cf4728-0a47-4ca4-854e-b5da694d87fe
    type: title
    task:
      id: 87cf4728-0a47-4ca4-854e-b5da694d87fe
      version: -1
      name: Domain registrant in approved list
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "28"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -230,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "24":
    id: "24"
    taskid: a8d7d880-46c3-4b04-8ca9-0394a42f1c88
    type: title
    task:
      id: a8d7d880-46c3-4b04-8ca9-0394a42f1c88
      version: -1
      name: Domain registrant not in approved list
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "20"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 240,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "25":
    id: "25"
    taskid: 55884370-bce5-43b9-8daa-ce8e94c99240
    type: regular
    task:
      id: 55884370-bce5-43b9-8daa-ce8e94c99240
      version: -1
      name: Set Results
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Results
      stringify: {}
      value:
        simple: ${inputs.WhoisResults}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "26":
    id: "26"
    taskid: 66b81388-3784-4887-85e2-d4ac600e80f1
    type: regular
    task:
      id: 66b81388-3784-4887-85e2-d4ac600e80f1
      version: -1
      name: Tag as approved registrant
      description: Tags the indicator with the approved_registrant tag.
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: approved_registrant
      indicatorsValues:
        simple: ${ApprovedRegistrantDomains}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -320,
          "y": 1220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "27":
    id: "27"
    taskid: f1b25a8e-a6ae-41ab-8f3d-30689c64b0a8
    type: regular
    task:
      id: f1b25a8e-a6ae-41ab-8f3d-30689c64b0a8
      version: -1
      name: Set domains without Whois results
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: DomainsNotResolvedByWhois
      stringify: {}
      value:
        complex:
          root: Results
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: Results.Whois.QueryResult
                iscontext: true
              right:
                value:
                  simple: "true"
          accessor: Whois.QueryValue
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1260,
          "y": 1100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "28":
    id: "28"
    taskid: 51971516-ed0b-4150-8b78-d7ccbf90506b
    type: condition
    task:
      id: 51971516-ed0b-4150-8b78-d7ccbf90506b
      version: -1
      name: Are there there domains with an approved registrant?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: List.In
            iscontext: true
    view: |-
      {
        "position": {
          "x": -90,
          "y": 875
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1725,
        "width": 2370,
        "x": -1260,
        "y": -240
      }
    }
  }
inputs:
- key: ""
  value: {}
  required: false
  description: ""
  playbookInputQuery:
    query: ""
    queryEntity: indicators
    results: null
    daterange:
      fromdate: 0001-01-01T00:00:00Z
      todate: 0001-01-01T00:00:00Z
      period:
        by: ""
        byto: ""
        byfrom: ""
        tovalue: null
        fromvalue: null
        field: ""
      fromdatelicenseval: 0001-01-01T00:00:00Z
    runFromLastJobTime: false
- key: ApprovedregistrantsListName
  value: {}
  required: false
  description: The Cortex XSOAR list name that contains the approved registrars.  A
    registrant is the company or entity  that owns the domain.
  playbookInputQuery: null
- key: RegistrantListDelimiter
  value:
    simple: ','
  required: false
  description: |-
    A one-character string used to delimit fields. This must match the value that you defined in the list separator server configuration.
    The default value is a comma, however, as registrants might contain the "," character in their name,
    Cortex XSOAR recommends that you select a different delimiter.
  playbookInputQuery: null
- key: WhoisResults
  value: {}
  required: false
  description: This input receives the Whois results from the parent playbook.
  playbookInputQuery: null
outputs:
- contextPath: RegistrantDomainNotInList
  description: Domains for which the registrant wasn't in the list.
  type: string
- contextPath: RegistrantDomainInList
  description: Domains for which the registrant was in the list.
  type: string
- contextPath: DomainsNotResolvedByWhois
  description: Domains which Whois wasn't able to resolve.
  type: string
- contextPath: DomainsNotProcessed
  description: In case no registrant list was provided all domains will be outputted
    to this context path.
  type: string
quiet: true
tests:
- No test