GetDomainDNSDetails

Returns DNS details for a domain.

python · Common Scripts

Details

IDGetDomainDNSDetails
Languagepython
From Version5.0.0
Docker Imagedemisto/netutils:1.0.0.11867191

README

Returns DNS details for a domain

Script Data


Name Description
Script Type python3
Tags  
Cortex XSOAR Version 5.0.0

Inputs


Argument Name Description
domain The domain to query
server IP of the DNS Server to use (default: system settings)
use_tcp Use TCP for the query (default: False)
qtype Comma separated list of query types (default: CNAME,NS,A,AAAA)

Outputs


Path Description Type
DomainDNSDetails.A Domain A records. String
DomainDNSDetails.AAAA Domain AAAA records. String
DomainDNSDetails.CNAME Domain CNAME records. String
DomainDNSDetails.NS Domain NS records. String
DomainDNSDetails.domain Domain name used in the query. String
DomainDNSDetails.server Name server that returned the result. String

Script Example

!GetDomainDNSDetails domain=example.com

Context Example

{
    "DomainDNSDetails": {
        "A": [
            "10.11.12.13"
        ],
        "AAAA": [
            "2001:2001:200:1:200:2001:2001:2001"
        ],
        "CNAME": [
            "test.example.com"
        ],
        "NS": [
            "a.iana-servers.net.",
            "b.iana-servers.net."
        ],
        "domain": "example.com",
        "server": "system"
    }
}

Human Readable Output

 Domain DNS Details for example.com

domain server CNAME NS A AAAA
example.com system test.example.com a.iana-servers.net.,
b.iana-servers.net.
10.11.12.13 2001:2001:200:1:200:2001:2001:2001
from typing import TYPE_CHECKING, cast

import dns.rdatatype
from GetDomainDNSDetails import get_domain_dns_details_command, make_query

if TYPE_CHECKING:
    import dns.resolver


class MockRData:
    def __init__(self, name, rdtype, rdclass):
        self.rdtype = rdtype
        self.rdclass = rdclass
        self.name = name

    def to_text(self):
        return self.name


class MockAnswer:
    def __init__(self, rrset: list[MockRData]):
        self.rrset = rrset


class MockResolver:
    def __init__(self):
        self.nameservers = []

    def resolve(self, qname, rdtype, rdclass, tcp=None, lifetime=None, raise_on_no_answer=None):
        return MockAnswer(
            [MockRData(f"fake{dns.rdatatype.to_text(rdtype)}", rdtype, rdclass), MockRData("fakename2", "fake", "fake")]
        )


def test_make_query(mocker):
    """
    Given:
        - dns resolver object
        - arguments: domain and query type (CNAME)
    When
        - testing function used in the script (not exposed)
    Then
        - CNAME of the domain is returned
    """
    resolver = cast("dns.resolver.Resolver", MockResolver())
    answer = make_query(resolver, "example.com", "CNAME", False)

    assert len(answer) == 1
    assert "CNAME" in answer
    assert len(answer["CNAME"]) == 1
    assert answer["CNAME"][0] == "fakeCNAME"


def test_get_domain_dns_details_command(mocker):
    """
    Given:
        - arguments: domain and dns servers
    When
        - resolving domain with default queries (CNAME, A, AAA)
    Then
        - resolution is performed
        - expected output is returned to context in DomainDNSDetails
    """
    mocker.patch("dns.resolver.Resolver", side_effect=MockResolver)
    args = {"domain": "developers.paloaltonetworks.com", "server": "1.1.1.1"}

    result = get_domain_dns_details_command(args)

    assert result.outputs == {
        "DomainDNSDetails": {
            "domain": "developers.paloaltonetworks.com",
            "server": "1.1.1.1",
            "A": ["fakeA"],
            "AAAA": ["fakeAAAA"],
            "CNAME": ["fakeCNAME"],
            "NS": ["fakeNS"],
        }
    }