TIM - Process Domains With Whois

This playbook uses several sub playbooks to process and tag indicators based on the results of the Whois tool.

Whois · 9 tasks · 2 inputs · 6 outputs

Inputs

  • CheckForWhoisRegistrant — Setting this input as True will run the TIM - Process Domain registrant With Whois playbook.
  • CheckForWhoisDomainAgeCreation — Setting this input as True will run the TIM - Process Domain Creation Age With Whois playbook.

Outputs

  • DomainsNotApproved — Domains for which the registrant isn't approved.
  • ApprovedRegistrantDomains — Domains for which the registrant is approved.
  • DomainsNotResolvedByWhois — Domains Not Resolved By Whois.
  • NewDomains — Domains whose create value is after the tested date.
  • NotNewDomains — Domains whose create value is before the tested date.
  • DomainsNotProcessed — Domains that could not be processed for any reason are outputted to this context path.

Commands used

whois

Flowchart

yes #error# yes yes yes Start Start Are there query results? Are there query results? Done Done Run Whois on domain indicators - whois Run Whois on domain indic... whois Was the registrant check enabled? Was the registrant check ... TIM - Process Domain Registrant With Whois - TIM - Process Domain Registrant With Whois TIM - Process Domain Regi... TIM - Process Domain Registra... Was the domain creation date check enabled? Was the domain creation d... TIM - Process Domain Age With Whois - TIM - Process Domain Age With Whois TIM - Process Domain Age ... TIM - Process Domain Age With... Is Whois enabled? Is Whois enabled?