CheckPivotableDomains

Checks for guided pivots for a given domain.

Details

ID	`CheckPivotableDomains`
Language	python
From Version	6.6.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	DomainTools

README

Checks for guided pivots for a given domain.

Script Data

Name	Description
Script Type	python3
Tags	DomainTools

Used In

This script is used in the following playbooks and scripts.

DomainTools Auto Pivots

Inputs

Argument Name	Description
domaintools_data	DomainTools context data for a domain
max_registrant_contact_name_count	Max threshold count that can be pivoted to a registrant contact name
max_registrant_org_count	Max threshold count that can be pivoted to a registrant org name
max_registrar_count	Max threshold count that can be pivoted to a registrar
max_ssl_info_organization_count	Max threshold count that can be pivoted to a ssl organization
max_ssl_info_hash_count	Max threshold count that can be pivoted to a ssl hash
max_ssl_email_count	Max threshold count that can be pivoted to a ssl email
max_ssl_subject_count	Max threshold count that can be pivoted to a ssl subject
max_name_server_host_count	Max threshold count that can be pivoted to a ssl subject
max_name_server_ip_count	Max threshold count that can be pivoted to a nameserver ip
max_name_server_domain_count	Max threshold count that can be pivoted to a nameserver domain
max_soa_email_count	Max threshold count that can be pivoted to a soa email
max_ip_address_count	Max threshold count that can be pivoted to an IP address
max_mx_ip_count	Max threshold count that can be pivoted to a MX IP
max_mx_host_count	Max threshold count that can be pivoted to a MX Host
max_mx_domain_count	Max threshold count that can be pivoted to a MX Domain
max_google_adsense_count	Max threshold count that can be pivoted to a google adsense
max_google_analytics_count	Max threshold count that can be pivoted to a google analytics

Outputs

Path	Description	Type
PivotableDomains.PivotableRegistrantContactName.pivotable	Is the domain’s registrant contact name a guided pivot.	Unknown
PivotableDomains.PivotableRegistrantContactName.items.count	Number of connected domains sharing the same registrant contact name.	Unknown
PivotableDomains.PivotableRegistrantContactName.items.value	Registrant contact name.	Unknown
PivotableDomains.PivotableRegistrantOrg.pivotable	Is the domain’s registrant org a guided pivot.	Unknown
PivotableDomains.PivotableRegistrantOrg.items.count	Number of connected domains sharing the same registrant org.	Unknown
PivotableDomains.PivotableRegistrantOrg.items.value	Registrant org.	Unknown
PivotableDomains.PivotableSslInfoOrganization.pivotable	Is the domain’s ssl org a guided pivot.	Unknown
PivotableDomains.PivotableSslInfoOrganization.items.count	Number of connected domains sharing the same ssl org.	Unknown
PivotableDomains.PivotableSslInfoOrganization.items.value	SSL org.	Unknown
PivotableDomains.PivotableSslInfoHash.pivotable	Is the domain’s ssl hash a guided pivot.	Unknown
PivotableDomains.PivotableSslInfoHash.items.count	Number of connected domains sharing the same ssl hash.	Unknown
PivotableDomains.PivotableSslInfoHash.items.value	SSL hash.	Unknown
PivotableDomains.PivotableNameServerHost.pivotable	Is the domain’s name server host a guided pivot.	Unknown
PivotableDomains.PivotableNameServerHost.items.count	Number of connected domains sharing the same name server host.	Unknown
PivotableDomains.PivotableNameServerHost.items.value	name server host.	Unknown
PivotableDomains.PivotableSoaEmail.pivotable	Is the domain’s name soa email a guided pivot.	Unknown
PivotableDomains.PivotableSoaEmail.items.count	Number of connected domains sharing the same name soa email.	Unknown
PivotableDomains.PivotableSoaEmail.items.value	soa email.	Unknown
PivotableDomains.PivotableIpAddress.pivotable	Is the domain’s IP address a guided pivot.	Unknown
PivotableDomains.PivotableIpAddress.items.count	Number of connected domains sharing the same IP address.	Unknown
PivotableDomains.PivotableIpAddress.items.value	IP address.	Unknown
PivotableDomains.PivotableNameServerIp.pivotable	Is the domain’s name server IP address a guided pivot.	Unknown
PivotableDomains.PivotableNameServerIp.items.count	Number of connected domains sharing the same name server IP address.	Unknown
PivotableDomains.PivotableNameServerIp.items.value	name server IP address.	Unknown
PivotableDomains.PivotableMxIp.pivotable	Is the domain’s mx IP address a guided pivot.	Unknown
PivotableDomains.PivotableMxIp.items.count	Number of connected domains sharing the same mx IP address.	Unknown
PivotableDomains.PivotableMxIp.items.value	mx IP address.	Unknown
PivotableDomains.PivotableRegistrar.pivotable	Is the domain’s registrar a guided pivot.	Unknown
PivotableDomains.PivotableRegistrar.items.count	Number of connected domains sharing the same registrar.	Unknown
PivotableDomains.PivotableRegistrar.items.value	Registrar.	Unknown
PivotableDomains.PivotableSslSubject.pivotable	Is the domain’s SSL subject a guided pivot.	Unknown
PivotableDomains.PivotableSslSubject.items.count	Number of connected domains sharing the SSL subject.	Unknown
PivotableDomains.PivotableSslSubject.items.value	SSL subject.	Unknown
PivotableDomains.PivotableSslEmail.pivotable	Is the domain’s SSL email a guided pivot.	Unknown
PivotableDomains.PivotableSslEmail.items.count	Number of connected domains sharing the SSL email.	Unknown
PivotableDomains.PivotableSslEmail.items.value	SSL email.	Unknown
PivotableDomains.PivotableNameServerDomain.pivotable	Is the domain’s name server domain a guided pivot.	Unknown
PivotableDomains.PivotableNameServerDomain.items.count	Number of connected domains sharing the name server domain.	Unknown
PivotableDomains.PivotableNameServerDomain.items.value	Name server domain.	Unknown
PivotableDomains.PivotableMxHost.pivotable	Is the domain’s mx host a guided pivot.	Unknown
PivotableDomains.PivotableMxHost.items.count	Number of connected domains sharing the mx host.	Unknown
PivotableDomains.PivotableMxHost.items.value	MX host.	Unknown
PivotableDomains.PivotableMxDomain.pivotable	Is the domain’s mx domain a guided pivot.	Unknown
PivotableDomains.PivotableMxDomain.items.count	Number of connected domains sharing the mx domain.	Unknown
PivotableDomains.PivotableMxDomain.items.value	MX domain.	Unknown
PivotableDomains.PivotableGoogleAnalytics.pivotable	Is the domain’s Google analytics a guided pivot.	Unknown
PivotableDomains.PivotableGoogleAnalytics.items.count	Number of connected domains sharing the Google analytics.	Unknown
PivotableDomains.PivotableGoogleAnalytics.items.value	Google analytics.	Unknown
PivotableDomains.PivotableAdsense.pivotable	Is the domain’s adsense a guided pivot.	Unknown
PivotableDomains.PivotableAdsense.items.count	Number of connected domains sharing the adsense.	Unknown
PivotableDomains.PivotableAdsense.items.value	Adsense.	Unknown

Source

CheckPivotableDomains.py CheckPivotableDomains_test.py CheckPivotableDomains.yml

Download History Raw

from CheckPivotableDomains import main
from CommonServerPython import *


def test_check_pivotable_output(mocker):
    domaintools_data = {
        "Name": "demisto.com",
        "LastEnriched": "2023-11-10",
        "Analytics": {
            "OverallRiskScore": 0,
            "ProximityRiskScore": 0,
            "MalwareRiskScore": 0,
            "PhishingRiskScore": 0,
            "SpamRiskScore": 0,
            "ThreatProfileRiskScore": {"RiskScore": 0, "Threats": "", "Evidence": ""},
            "WebsiteResponseCode": 200,
            "GoogleAdsenseTrackingCode": {"value": "", "count": 0},
            "GoogleAnalyticTrackingCode": {"value": "", "count": 0},
            "Tags": [],
        },
        "Identity": {
            "RegistrantName": "",
            "RegistrantOrg": "Palo Alto Networks, Inc.",
            "RegistrantContact": {
                "Country": {"value": "us", "count": 275572451},
                "Email": [
                    {
                        "value": "select request email form at https://domains.markmonitor.com/whois/demisto.com",
                        "count": 1,
                    }
                ],
                "Name": {"value": "just a test", "count": 200},
                "Phone": {"value": "", "count": 0},
                "Street": {"value": "", "count": 0},
                "City": {"value": "", "count": 0},
                "State": {"value": "CA", "count": 18232716},
                "Postal": {"value": "", "count": 0},
                "Org": {"value": "Palo Alto Networks, Inc.", "count": 200},
            },
            "Registrar": {"value": "MarkMonitor, Inc.", "count": 867819},
            "SOAEmail": [{"value": "it-staff-sysadmin@example.com", "count": 34}],
            "SSLCertificateEmail": [],
            "AdminContact": {
                "Country": {"value": "us", "count": 275572451},
                "Email": [
                    {
                        "value": "select request email form at https://domains.markmonitor.com/whois/demisto.com",
                        "count": 1,
                    }
                ],
                "Name": {"value": "", "count": 0},
                "Phone": {"value": "", "count": 0},
                "Street": {"value": "", "count": 0},
                "City": {"value": "", "count": 0},
                "State": {"value": "CA", "count": 18232716},
                "Postal": {"value": "", "count": 0},
                "Org": {"value": "Palo Alto Networks, Inc.", "count": 645},
            },
            "TechnicalContact": {
                "Country": {"value": "us", "count": 275572451},
                "Email": [
                    {
                        "value": "select request email form at https://domains.markmonitor.com/whois/demisto.com",
                        "count": 1,
                    }
                ],
                "Name": {"value": "", "count": 0},
                "Phone": {"value": "", "count": 0},
                "Street": {"value": "", "count": 0},
                "City": {"value": "", "count": 0},
                "State": {"value": "CA", "count": 18232716},
                "Postal": {"value": "", "count": 0},
                "Org": {"value": "Palo Alto Networks, Inc.", "count": 645},
            },
            "BillingContact": {
                "Country": {"value": "", "count": 0},
                "Email": [],
                "Name": {"value": "", "count": 0},
                "Phone": {"value": "", "count": 0},
                "Street": {"value": "", "count": 0},
                "City": {"value": "", "count": 0},
                "State": {"value": "", "count": 0},
                "Postal": {"value": "", "count": 0},
                "Org": {"value": "", "count": 0},
            },
            "EmailDomains": ["markmonitor.com", "paloaltonetworks.com"],
            "AdditionalWhoisEmails": [
                {"value": "abusecomplaints@markmonitor.com", "count": 1291667},
                {"value": "whoisrequest@markmonitor.com", "count": 798372},
            ],
        },
        "Registration": {
            "RegistrarStatus": [
                "clientdeleteprohibited",
                "clienttransferprohibited",
                "clientupdateprohibited",
            ],
            "DomainStatus": True,
            "CreateDate": "2015-01-16",
            "ExpirationDate": "2028-01-16",
        },
        "Hosting": {
            "IPAddresses": [
                {
                    "address": {"value": "34.120.160.120", "count": 16},
                    "asn": [{"value": 396982, "count": 30156647}],
                    "country_code": {"value": "us", "count": 197334117},
                    "isp": {"value": "Google", "count": 56964370},
                }
            ],
            "IPCountryCode": "us",
            "MailServers": [
                {
                    "host": {"value": "mxa-00169c01.gslb.pphosted.com", "count": 1097},
                    "domain": {"value": "pphosted.com", "count": 148978},
                    "ip": [{"value": "67.231.156.123", "count": 854}],
                    "priority": 10,
                },
                {
                    "host": {"value": "mxb-00169c01.gslb.pphosted.com", "count": 1098},
                    "domain": {"value": "pphosted.com", "count": 148978},
                    "ip": [{"value": "67.231.156.123", "count": 854}],
                    "priority": 10,
                },
            ],
            "SPFRecord": "",
            "NameServers": [
                {
                    "host": {"value": "pdns112.ultradns.net", "count": 200},
                    "domain": {"value": "ultradns.net", "count": 200},
                    "ip": [{"value": "156.154.65.112", "count": 200}],
                },
                {
                    "host": {"value": "pdns112.ultradns.com", "count": 369},
                    "domain": {"value": "ultradns.com", "count": 651583},
                    "ip": [{"value": "156.154.64.112", "count": 369}],
                },
                {
                    "host": {"value": "pdns112.ultradns.biz", "count": 369},
                    "domain": {"value": "ultradns.biz", "count": 648560},
                    "ip": [{"value": "156.154.66.112", "count": 369}],
                },
                {
                    "host": {"value": "pdns112.ultradns.org", "count": 369},
                    "domain": {"value": "ultradns.org", "count": 762389},
                    "ip": [{"value": "156.154.67.112", "count": 369}],
                },
            ],
            "SSLCertificate": [
                {
                    "hash": {
                        "value": "9eb6468deaea5a1c9d022ebaa3694e9ce2f9dce8",
                        "count": 10,
                    },
                    "subject": {"value": "CN=demisto.com", "count": 2},
                    "organization": {"value": "just a test org", "count": 20},
                    "email": [],
                    "alt_names": [
                        {"value": "blog.demisto.com", "count": 0},
                        {"value": "go.demisto.com", "count": 0},
                        {"value": "info.demisto.com", "count": 0},
                        {"value": "demisto.com", "count": 0},
                        {"value": "www.demisto.com", "count": 0},
                    ],
                    "common_name": {"value": "demisto.com", "count": 1},
                    "issuer_common_name": {
                        "value": "Go Daddy Secure Certificate Authority - G2",
                        "count": 18413841,
                    },
                    "not_after": {"value": 20240716, "count": 180059},
                    "not_before": {"value": 20230717, "count": 343154},
                    "duration": {"value": 365, "count": 10714248},
                }
            ],
            "RedirectsTo": {"value": "www.paloaltonetworks.com", "count": 16},
            "RedirectDomain": {"value": "paloaltonetworks.com", "count": 27},
        },
        "WebsiteTitle": "",
        "FirstSeen": "2015-01-16T00:00:00Z",
        "ServerType": "",
    }

    mocker.patch.object(
        demisto,
        "args",
        return_value={
            "domaintools_data": domaintools_data,
            "max_name_server_host_count": "250",
            "max_name_server_ip_count": "250",
            "max_name_server_domain_count": "250",
            "max_registrant_contact_name_count": "250",
            "max_registrant_org_count": "250",
            "max_registrar_count": "200",
            "max_ssl_info_organization_count": "350",
            "max_ssl_info_hash_count": "350",
            "max_ssl_email_count": "350",
            "max_ssl_subject_count": "350",
            "max_soa_email_count": "200",
            "max_ip_address_count": "200",
            "max_mx_ip_count": "200",
            "max_mx_host_count": "200",
            "max_mx_domain_count": "200",
            "max_google_adsense_count": "200",
            "max_google_analytics_count": "200",
        },
    )
    mocker.patch.object(demisto, "results")
    main()

    expected_context = {
        "Name": "demisto.com",
        "PivotableRegistrantContactName": {"pivotable": True, "items": {"count": 200, "value": "just a test"}},
        "PivotableRegistrantOrg": {"pivotable": True, "items": {"count": 200, "value": "Palo Alto Networks, Inc."}},
        "PivotableRegistrar": {"pivotalbe": False},
        "PivotableSslInfoOrganization": {"pivotable": True, "items": [{"count": 20, "value": "just a test org"}]},
        "PivotableSslInfoHash": {
            "pivotable": True,
            "items": [{"count": 10, "value": "9eb6468deaea5a1c9d022ebaa3694e9ce2f9dce8"}],
        },
        "PivotableSslSubject": {"pivotable": True, "items": [{"count": 2, "value": "CN=demisto.com"}]},
        "PivotableSslEmail": {"pivotable": False},
        "PivotableNameServerHost": {"pivotable": True, "items": [{"count": 200, "value": "pdns112.ultradns.net"}]},
        "PivotableNameServerIp": {"pivotable": True, "items": [{"count": 200, "value": "156.154.65.112"}]},
        "PivotableNameServerDomain": {"pivotable": True, "items": [{"count": 200, "value": "ultradns.net"}]},
        "PivotableSoaEmail": {"pivotable": True, "items": [{"count": 34, "value": "it-staff-sysadmin@example.com"}]},
        "PivotableIpAddress": {"pivotable": True, "items": [{"count": 16, "value": "34.120.160.120"}]},
        "PivotableMxIp": {"pivotable": False},
        "PivotableMxHost": {"pivotable": False},
        "PivotableMxDomain": {"pivotable": False},
        "PivotableGoogleAnalytics": {"pivotable": False},
        "PivotableAdsense": {"pivotable": False},
    }

    assert demisto.results.call_count == 1
    results = demisto.results.call_args[0]
    assert len(results) == 1
    assert results[0]["Type"] == entryTypes["note"]
    assert results[0]["ContentsFormat"] == formats["json"]
    assert results[0]["Contents"] == expected_context