DomainExtractAndEnrich
Resolves a URL or fully qualified domain name (FQDN) and looks up a complete profile of the domain on the DomainTools Iris Enrich API.
python · DomainTools Iris Investigate
Details
| ID | DomainExtractAndEnrich |
|---|---|
| Language | python |
| From Version | 6.6.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Tags | DomainTools |
README
Resolves a URL or fully qualified domain name (FQDN) and looks up a complete profile of the domain on the DomainTools Iris Enrich API.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | DomainTools |
| Cortex XSOAR Version | 6.9.0 |
Dependencies
This script uses the following commands and scripts.
- domaintoolsiris-enrich
- DomainTools Iris
- ExtractDomainFromUrlAndEmail
Inputs
| Argument Name | Description |
|---|---|
| url | Resolve and enrich domains from this URL. Also accepts a comma-separated list of up to 6,000 URLs. |
| include_context | Optionally include the investigate results into the Context Data. Defaults to false. |
Outputs
| Path | Description | Type |
|---|---|---|
| Domain.Name | The name of the domain. | String |
| Domain.DNS | The DNS of the domain. | String |
| Domain.DomainStatus | The status of the domain. | Boolean |
| Domain.CreationDate | The creation date. | Date |
| Domain.ExpirationDate | The expiration date of the domain. | Date |
| Domain.NameServers | The nameServers of the domain. | String |
| Domain.Registrant.Country | The registrant country of the domain. | String |
| Domain.Registrant.Email | The registrant email of the domain. | String |
| Domain.Registrant.Name | The registrant name of the domain. | String |
| Domain.Registrant.Phone | The registrant phone number of the domain. | String |
| Domain.Malicious.Vendor | The vendor who classified the domain as malicious. | String |
| Domain.Malicious.Description | The description as to why the domain was found to be malicious. | String |
| DomainTools.Domains.Name | The domain name in DomainTools. | String |
| DomainTools.Domains.LastEnriched | The last Time DomainTools enriched domain data. | Date |
| DomainTools.Domains.Analytics.OverallRiskScore | The Overall Risk Score in DomainTools. | Number |
| DomainTools.Domains.Analytics.ProximityRiskScore | The Proximity Risk Score in DomainTools. | Number |
| DomainTools.Domains.Analytics.ThreatProfileRiskScore.RiskScore | The Threat Profile Risk Score in DomainTools. | Number |
| DomainTools.Domains.Analytics.ThreatProfileRiskScore.Threats | The threats of the Threat Profile Risk Score in DomainTools. | String |
| DomainTools.Domains.Analytics.ThreatProfileRiskScore.Evidence | The Threat Profile Risk Score Evidence in DomainTools. | String |
| DomainTools.Domains.Analytics.WebsiteResponseCode | The Website Response Code in DomainTools. | Number |
| DomainTools.Domains.Analytics.AlexaRank | The Alexa Rank in DomainTools. | Number |
| DomainTools.Domains.Analytics.Tags | The Tags in DomainTools. | String |
| DomainTools.Domains.Identity.RegistrantName | The name of the registrant. | String |
| DomainTools.Domains.Identity.RegistrantOrg | The organization of the registrant. | String |
| DomainTools.Domains.Identity.RegistrantContact.Country.value | The country value of the registrant contact. | String |
| DomainTools.Domains.Identity.RegistrantContact.Country.count | The count of the registrant contact country. | Number |
| DomainTools.Domains.Identity.RegistrantContact.Email.value | The Email value of the registrant contact. | String |
| DomainTools.Domains.Identity.RegistrantContact.Email.count | The Email count of the registrant contact. | Number |
| DomainTools.Domains.Identity.RegistrantContact.Name.value | The name value of the registrant contact. | String |
| DomainTools.Domains.Identity.RegistrantContact.Name.count | The name count of the registrant contact. | Number |
| DomainTools.Domains.Identity.RegistrantContact.Phone.value | The phone value of the registrant contact. | String |
| DomainTools.Domains.Identity.RegistrantContact.Phone.count | The phone count of the registrant contact. | Number |
| DomainTools.Domains.Identity.SOAEmail | The SOA record of the Email. | String |
| DomainTools.Domains.Identity.SSLCertificateEmail | The Email of the SSL certificate. | String |
| DomainTools.Domains.Identity.AdminContact.Country.value | The country value of the administrator contact. | String |
| DomainTools.Domains.Identity.AdminContact.Country.count | The country count of the administrator contact. | Number |
| DomainTools.Domains.Identity.AdminContact.Email.value | The Email value of the administrator contact. | String |
| DomainTools.Domains.Identity.AdminContact.Email.count | The Email count of the administrator contact. | Number |
| DomainTools.Domains.Identity.AdminContact.Name.value | The name value of the administrator contact. | String |
| DomainTools.Domains.Identity.AdminContact.Name.count | The name count of the administrator contact. | Number |
| DomainTools.Domains.Identity.AdminContact.Phone.value | The phone value of the administrator contact. | String |
| DomainTools.Domains.Identity.AdminContact.Phone.count | The phone count of the administrator contact. | Number |
| DomainTools.Domains.Identity.TechnicalContact.Country.value | The country value of the technical contact. | String |
| DomainTools.Domains.Identity.TechnicalContact.Country.count | The country count of the technical contact. | Number |
| DomainTools.Domains.Identity.TechnicalContact.Email.value | The Email value of the technical contact. | String |
| DomainTools.Domains.Identity.TechnicalContact.Email.count | The Email count of the technical contact. | Number |
| DomainTools.Domains.Identity.TechnicalContact.Name.value | The name value of the technical Contact. | String |
| DomainTools.Domains.Identity.TechnicalContact.Name.count | The name count of the technical contact. | Number |
| DomainTools.Domains.Identity.TechnicalContact.Phone.value | The phone value of the technical contact. | String |
| DomainTools.Domains.Identity.TechnicalContact.Phone.count | The phone count of the technical contact. | Number |
| DomainTools.Domains.Identity.BillingContact.Country.value | The country value of the billing contact. | String |
| DomainTools.Domains.Identity.BillingContact.Country.count | The country count of the billing contact. | Number |
| DomainTools.Domains.Identity.BillingContact.Email.value | The Email value of the billing contact. | String |
| DomainTools.Domains.Identity.BillingContact.Email.count | The Email count of the billing contact. | Number |
| DomainTools.Domains.Identity.BillingContact.Name.value | The name value of the billing contact. | String |
| DomainTools.Domains.Identity.BillingContact.Name.count | The name count of the billing contact. | Number |
| DomainTools.Domains.Identity.BillingContact.Phone.value | The phone value of the billing contact. | String |
| DomainTools.Domains.Identity.BillingContact.Phone.count | The phone count of the billing contact. | Number |
| DomainTools.Domains.Identity.EmailDomains | The Email Domains. | String |
| DomainTools.Domains.Identity.AdditionalWhoisEmails.value | The value of the Additional Whois Emails record. | String |
| DomainTools.Domains.Identity.AdditionalWhoisEmails.count | The count of the Additional Whois Emails record. | Number |
| DomainTools.Domains.Registration.DomainRegistrant | The registrant of the domain. | String |
| DomainTools.Domains.Registration.RegistrarStatus | The status of the registrar. | String |
| DomainTools.Domains.Registration.DomainStatus | The active status of the domain. | Boolean |
| DomainTools.Domains.Registration.CreateDate | The date the domain was created. | Date |
| DomainTools.Domains.Registration.ExpirationDate | The expiration date of the domain. | Date |
| DomainTools.Domains.Hosting.IPAddresses.address.value | The address value of IP addresses. | String |
| DomainTools.Domains.Hosting.IPAddresses.address.count | The address count of IP addresses. | Number |
| DomainTools.Domains.Hosting.IPAddresses.asn.value | The ASN value of IP addresses. | String |
| DomainTools.Domains.Hosting.IPAddresses.asn.count | The ASN count of IP addresses. | Number |
| DomainTools.Domains.Hosting.IPAddresses.country_code.value | The country code value of IP addresses. | String |
| DomainTools.Domains.Hosting.IPAddresses.country_code.count | The country code count of IP addresses. | Number |
| DomainTools.Domains.Hosting.IPAddresses.isp.value | The ISP value of IP addresses. | String |
| DomainTools.Domains.Hosting.IPAddresses.isp.count | The ISP count of IP addresses. | Number |
| DomainTools.Domains.Hosting.IPCountryCode | The country code of the IP address. | String |
| DomainTools.Domains.Hosting.MailServers.domain.value | The domain value of the Mail Servers. | String |
| DomainTools.Domains.Hosting.MailServers.domain.count | The domain count of the Mail Servers. | Number |
| DomainTools.Domains.Hosting.MailServers.host.value | The host value of the Mail Servers. | String |
| DomainTools.Domains.Hosting.MailServers.host.count | The host count of the Mail Servers. | Number |
| DomainTools.Domains.Hosting.MailServers.ip.value | The IP value of the Mail Servers. | String |
| DomainTools.Domains.Hosting.MailServers.ip.count | The IP count of the Mail Servers. | Number |
| DomainTools.Domains.Hosting.SPFRecord | The SPF Record. | String |
| DomainTools.Domains.Hosting.NameServers.domain.value | The domain value of the domain NameServers. | String |
| DomainTools.Domains.Hosting.NameServers.domain.count | The domain count of the domain NameServers. | Number |
| DomainTools.Domains.Hosting.NameServers.host.value | The host value of the domain NameServers. | String |
| DomainTools.Domains.Hosting.NameServers.host.count | The host count of the domain NameServers. | Number |
| DomainTools.Domains.Hosting.NameServers.ip.value | The IP value of the domain NameServers. | String |
| DomainTools.Domains.Hosting.NameServers.ip.count | The IP count of domain NameServers. | Number |
| DomainTools.Domains.Hosting.SSLCertificate.hash.value | The hash value of the SSL certificate. | String |
| DomainTools.Domains.Hosting.SSLCertificate.hash.count | The hash count of the SSL certificate. | Number |
| DomainTools.Domains.Hosting.SSLCertificate.organization.value | The organization value of the SSL certificate. | String |
| DomainTools.Domains.Hosting.SSLCertificate.organization.count | The organization count of the SSL certificate information. | Number |
| DomainTools.Domains.Hosting.SSLCertificate.subject.value | The subject value of the SSL certificate information. | String |
| DomainTools.Domains.Hosting.SSLCertificate.subject.count | The subject count of the SSL certificate information. | Number |
| DomainTools.Domains.Hosting.RedirectsTo.value | The Redirects To Value of the domain. | String |
| DomainTools.Domains.Hosting.RedirectsTo.count | The Redirects To Count of the domain. | Number |
| DomainTools.Domains.Analytics.GoogleAdsenseTrackingCode | The tracking code of Google Adsense. | Number |
| DomainTools.Domains.Analytics.GoogleAnalyticTrackingCode | The tracking code of Google Analytics. | Number |
| DBotScore.Indicator | The indicator of the DBotScore. | String |
| DBotScore.Type | The indicator type of the DBotScore. | String |
| DBotScore.Vendor | The vendor used to calculate the score. | String |
| DBotScore.Score | The actual score. | Number |
args: - default: false description: Resolve and enrich domains from this URL. Also accepts a comma-separated list of up to 6,000 URLs. isArray: false name: url required: true secret: false - default: false description: Optionally include the investigate results into the Context Data. defaultValue: 'false' isArray: false name: include_context required: false secret: false comment: Resolves a URL or fully qualified domain name (FQDN) and looks up a complete profile of the domain on the DomainTools Iris Enrich API. commonfields: id: DomainExtractAndEnrich version: -1 enabled: true name: DomainExtractAndEnrich outputs: - contextPath: Domain.Name description: The name of the domain. type: String - contextPath: Domain.DNS description: The DNS of the domain. type: String - contextPath: Domain.DomainStatus description: The status of the domain. type: Boolean - contextPath: Domain.CreationDate description: The creation date. type: Date - contextPath: Domain.ExpirationDate description: The expiration date of the domain. type: Date - contextPath: Domain.NameServers description: The nameServers of the domain. type: String - contextPath: Domain.Registrant.Country description: The registrant country of the domain. type: String - contextPath: Domain.Registrant.Email description: The registrant email of the domain. type: String - contextPath: Domain.Registrant.Name description: The registrant name of the domain. type: String - contextPath: Domain.Registrant.Phone description: The registrant phone number of the domain. type: String - contextPath: Domain.Malicious.Vendor description: The vendor who classified the domain as malicious. type: String - contextPath: Domain.Malicious.Description description: The description as to why the domain was found to be malicious. type: String - contextPath: DomainTools.Domains.Name description: The domain name in DomainTools. type: String - contextPath: DomainTools.Domains.LastEnriched description: The last Time DomainTools enriched domain data. type: Date - contextPath: DomainTools.Domains.Analytics.OverallRiskScore description: The Overall Risk Score in DomainTools. type: Number - contextPath: DomainTools.Domains.Analytics.ProximityRiskScore description: The Proximity Risk Score in DomainTools. type: Number - contextPath: DomainTools.Domains.Analytics.ThreatProfileRiskScore.RiskScore description: The Threat Profile Risk Score in DomainTools. type: Number - contextPath: DomainTools.Domains.Analytics.ThreatProfileRiskScore.Threats description: The threats of the Threat Profile Risk Score in DomainTools. type: String - contextPath: DomainTools.Domains.Analytics.ThreatProfileRiskScore.Evidence description: The Threat Profile Risk Score Evidence in DomainTools. type: String - contextPath: DomainTools.Domains.Analytics.WebsiteResponseCode description: The Website Response Code in DomainTools. type: Number - contextPath: DomainTools.Domains.Analytics.AlexaRank description: The Alexa Rank in DomainTools. type: Number - contextPath: DomainTools.Domains.Analytics.Tags description: The Tags in DomainTools. type: String - contextPath: DomainTools.Domains.Identity.RegistrantName description: The name of the registrant. type: String - contextPath: DomainTools.Domains.Identity.RegistrantOrg description: The organization of the registrant. type: String - contextPath: DomainTools.Domains.Identity.RegistrantContact.Country.value description: The country value of the registrant contact. type: String - contextPath: DomainTools.Domains.Identity.RegistrantContact.Country.count description: The count of the registrant contact country. type: Number - contextPath: DomainTools.Domains.Identity.RegistrantContact.Email.value description: The Email value of the registrant contact. type: String - contextPath: DomainTools.Domains.Identity.RegistrantContact.Email.count description: The Email count of the registrant contact. type: Number - contextPath: DomainTools.Domains.Identity.RegistrantContact.Name.value description: The name value of the registrant contact. type: String - contextPath: DomainTools.Domains.Identity.RegistrantContact.Name.count description: The name count of the registrant contact. type: Number - contextPath: DomainTools.Domains.Identity.RegistrantContact.Phone.value description: The phone value of the registrant contact. type: String - contextPath: DomainTools.Domains.Identity.RegistrantContact.Phone.count description: The phone count of the registrant contact. type: Number - contextPath: DomainTools.Domains.Identity.SOAEmail description: The SOA record of the Email. type: String - contextPath: DomainTools.Domains.Identity.SSLCertificateEmail description: The Email of the SSL certificate. type: String - contextPath: DomainTools.Domains.Identity.AdminContact.Country.value description: The country value of the administrator contact. type: String - contextPath: DomainTools.Domains.Identity.AdminContact.Country.count description: The country count of the administrator contact. type: Number - contextPath: DomainTools.Domains.Identity.AdminContact.Email.value description: The Email value of the administrator contact. type: String - contextPath: DomainTools.Domains.Identity.AdminContact.Email.count description: The Email count of the administrator contact. type: Number - contextPath: DomainTools.Domains.Identity.AdminContact.Name.value description: The name value of the administrator contact. type: String - contextPath: DomainTools.Domains.Identity.AdminContact.Name.count description: The name count of the administrator contact. type: Number - contextPath: DomainTools.Domains.Identity.AdminContact.Phone.value description: The phone value of the administrator contact. type: String - contextPath: DomainTools.Domains.Identity.AdminContact.Phone.count description: The phone count of the administrator contact. type: Number - contextPath: DomainTools.Domains.Identity.TechnicalContact.Country.value description: The country value of the technical contact. type: String - contextPath: DomainTools.Domains.Identity.TechnicalContact.Country.count description: The country count of the technical contact. type: Number - contextPath: DomainTools.Domains.Identity.TechnicalContact.Email.value description: The Email value of the technical contact. type: String - contextPath: DomainTools.Domains.Identity.TechnicalContact.Email.count description: The Email count of the technical contact. type: Number - contextPath: DomainTools.Domains.Identity.TechnicalContact.Name.value description: The name value of the technical Contact. type: String - contextPath: DomainTools.Domains.Identity.TechnicalContact.Name.count description: The name count of the technical contact. type: Number - contextPath: DomainTools.Domains.Identity.TechnicalContact.Phone.value description: The phone value of the technical contact. type: String - contextPath: DomainTools.Domains.Identity.TechnicalContact.Phone.count description: The phone count of the technical contact. type: Number - contextPath: DomainTools.Domains.Identity.BillingContact.Country.value description: The country value of the billing contact. type: String - contextPath: DomainTools.Domains.Identity.BillingContact.Country.count description: The country count of the billing contact. type: Number - contextPath: DomainTools.Domains.Identity.BillingContact.Email.value description: The Email value of the billing contact. type: String - contextPath: DomainTools.Domains.Identity.BillingContact.Email.count description: The Email count of the billing contact. type: Number - contextPath: DomainTools.Domains.Identity.BillingContact.Name.value description: The name value of the billing contact. type: String - contextPath: DomainTools.Domains.Identity.BillingContact.Name.count description: The name count of the billing contact. type: Number - contextPath: DomainTools.Domains.Identity.BillingContact.Phone.value description: The phone value of the billing contact. type: String - contextPath: DomainTools.Domains.Identity.BillingContact.Phone.count description: The phone count of the billing contact. type: Number - contextPath: DomainTools.Domains.Identity.EmailDomains description: The Email Domains. type: String - contextPath: DomainTools.Domains.Identity.AdditionalWhoisEmails.value description: The value of the Additional Whois Emails record. type: String - contextPath: DomainTools.Domains.Identity.AdditionalWhoisEmails.count description: The count of the Additional Whois Emails record. type: Number - contextPath: DomainTools.Domains.Registration.DomainRegistrant description: The registrant of the domain. type: String - contextPath: DomainTools.Domains.Registration.RegistrarStatus description: The status of the registrar. type: String - contextPath: DomainTools.Domains.Registration.DomainStatus description: The active status of the domain. type: Boolean - contextPath: DomainTools.Domains.Registration.CreateDate description: The date the domain was created. type: Date - contextPath: DomainTools.Domains.Registration.ExpirationDate description: The expiration date of the domain. type: Date - contextPath: DomainTools.Domains.Hosting.IPAddresses.address.value description: The address value of IP addresses. type: String - contextPath: DomainTools.Domains.Hosting.IPAddresses.address.count description: The address count of IP addresses. type: Number - contextPath: DomainTools.Domains.Hosting.IPAddresses.asn.value description: The ASN value of IP addresses. type: String - contextPath: DomainTools.Domains.Hosting.IPAddresses.asn.count description: The ASN count of IP addresses. type: Number - contextPath: DomainTools.Domains.Hosting.IPAddresses.country_code.value description: The country code value of IP addresses. type: String - contextPath: DomainTools.Domains.Hosting.IPAddresses.country_code.count description: The country code count of IP addresses. type: Number - contextPath: DomainTools.Domains.Hosting.IPAddresses.isp.value description: The ISP value of IP addresses. type: String - contextPath: DomainTools.Domains.Hosting.IPAddresses.isp.count description: The ISP count of IP addresses. type: Number - contextPath: DomainTools.Domains.Hosting.IPCountryCode description: The country code of the IP address. type: String - contextPath: DomainTools.Domains.Hosting.MailServers.domain.value description: The domain value of the Mail Servers. type: String - contextPath: DomainTools.Domains.Hosting.MailServers.domain.count description: The domain count of the Mail Servers. type: Number - contextPath: DomainTools.Domains.Hosting.MailServers.host.value description: The host value of the Mail Servers. type: String - contextPath: DomainTools.Domains.Hosting.MailServers.host.count description: The host count of the Mail Servers. type: Number - contextPath: DomainTools.Domains.Hosting.MailServers.ip.value description: The IP value of the Mail Servers. type: String - contextPath: DomainTools.Domains.Hosting.MailServers.ip.count description: The IP count of the Mail Servers. type: Number - contextPath: DomainTools.Domains.Hosting.SPFRecord description: The SPF Record. type: String - contextPath: DomainTools.Domains.Hosting.NameServers.domain.value description: The domain value of the domain NameServers. type: String - contextPath: DomainTools.Domains.Hosting.NameServers.domain.count description: The domain count of the domain NameServers. type: Number - contextPath: DomainTools.Domains.Hosting.NameServers.host.value description: The host value of the domain NameServers. type: String - contextPath: DomainTools.Domains.Hosting.NameServers.host.count description: The host count of the domain NameServers. type: Number - contextPath: DomainTools.Domains.Hosting.NameServers.ip.value description: The IP value of the domain NameServers. type: String - contextPath: DomainTools.Domains.Hosting.NameServers.ip.count description: The IP count of domain NameServers. type: Number - contextPath: DomainTools.Domains.Hosting.SSLCertificate.hash.value description: The hash value of the SSL certificate. type: String - contextPath: DomainTools.Domains.Hosting.SSLCertificate.hash.count description: The hash count of the SSL certificate. type: Number - contextPath: DomainTools.Domains.Hosting.SSLCertificate.organization.value description: The organization value of the SSL certificate. type: String - contextPath: DomainTools.Domains.Hosting.SSLCertificate.organization.count description: The organization count of the SSL certificate information. type: Number - contextPath: DomainTools.Domains.Hosting.SSLCertificate.subject.value description: The subject value of the SSL certificate information. type: String - contextPath: DomainTools.Domains.Hosting.SSLCertificate.subject.count description: The subject count of the SSL certificate information. type: Number - contextPath: DomainTools.Domains.Hosting.RedirectsTo.value description: The Redirects To Value of the domain. type: String - contextPath: DomainTools.Domains.Hosting.RedirectsTo.count description: The Redirects To Count of the domain. type: Number - contextPath: DomainTools.Domains.Analytics.GoogleAdsenseTrackingCode description: The tracking code of Google Adsense. type: Number - contextPath: DomainTools.Domains.Analytics.GoogleAnalyticTrackingCode description: The tracking code of Google Analytics. type: Number - contextPath: DBotScore.Indicator description: The indicator of the DBotScore. type: String - contextPath: DBotScore.Type description: The indicator type of the DBotScore. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number script: '-' system: false tags: - DomainTools timeout: '0' type: python subtype: python3 fromversion: 6.6.0 dockerimage: demisto/python3:3.12.13.10116658 tests: - No tests (auto formatted)