category: Data Enrichment & Threat Intelligence
provider: LHC
commonfields:
  id: CIRCL
  version: -1
configuration:
- defaultvalue: https://www.circl.lu
  display: Server URL (e.g. https://www.circl.lu)
  name: url
  required: true
  type: 0
- display: Username
  name: credentials
  required: true
  type: 9
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
description: |-
  CIRCL Passive DNS is a database storing historical DNS records from various resources.
  CIRCL Passive SSL is a database storing historical X.509 certificates seen per IP address. The Passive SSL historical data is indexed per IP address.
display: CIRCL
name: CIRCL
script:
  commands:
  - arguments:
    - description: IP address, hostname, or domain name.
      name: queryValue
      required: true
    description: Get DNS records for your query value from CIRCL's Passive DNS.
    name: circl-dns-get
    outputs:
    - contextPath: CIRCLdns.Query.Value
      description: Query Value.
      type: string
    - contextPath: CIRCLdns.Query.Record.Data
      description: DNS Record or IP Address.
      type: string
    - contextPath: CIRCLdns.Query.Record.LastTime
      description: DNS record last recorded time.
      type: date
  - arguments:
    - description: IP address or CIDR block.
      name: queryValue
      required: true
    description: Query IP address or CIDR blocks (/32 up to /23) for SSL certificates history.
    name: circl-ssl-list-certificates
    outputs:
    - contextPath: CIRCLssl.IPAddress.Value
      description: IP address.
      type: string
    - contextPath: CIRCLssl.IPAddress.Certificate.SHA1
      description: ' The SHA-1 fingerprint of the certificate.'
      type: string
    - contextPath: CIRCLssl.IPAddress.Certificate.Subjects
      description: Certificate subjects.
      type: string
  - arguments:
    - description: SHA-1 fingerprint of a certificate.
      name: certificate
      required: true
    - defaultValue: '100'
      description: Limit the results number (Increasing number can cause browser slowdowns).
      name: limitResults
    description: Query a certificate value to get all associated addresses
    name: circl-ssl-query-certificate
    outputs:
    - contextPath: CIRCLssl.Certificate.SHA1
      description: ' The SHA-1 fingerprint of the certificate.'
      type: string
    - contextPath: CIRCLssl.Certificate.Hits
      description: Number of hits for the certificate (number of associated addresses).
      type: number
    - contextPath: CIRCLssl.Certificate.IPAddress
      description: IP address associated to the certificate.
      type: string
  - arguments:
    - description: SHA-1 fingerprint of a certificate.
      name: certificate
      required: true
    description: Get the raw certificate and related information.
    name: circl-ssl-get-certificate
    outputs:
    - contextPath: CIRCLssl.Certificate.SHA1
      description: The SHA-1 fingerprint of the certificate.
      type: string
    - contextPath: CIRCLssl.Certificate.Usage
      description: Extended key usage.
      type: string
    - contextPath: CIRCLssl.Certificate.Distribution
      description: CRL distribution points.
      type: string
    - contextPath: CIRCLssl.Certificate.Issuer
      description: Certificate issuer.
      type: string
    - contextPath: CIRCLssl.Certificate.Time
      description: Certificate issued time (***not_before).
      type: date
    - contextPath: CIRCLssl.Certificate.Subject
      description: Certificate subject.
      type: string
    - contextPath: CIRCLssl.Certificate.Key
      description: Certificate public key.
      type: string
    - contextPath: CIRCLssl.Certificate.Pem
      description: Certificate in PEM format.
      type: string
    - contextPath: CIRCLssl.Certificate.Seen
      description: Number of times the certificate was seen.
      type: number
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
tests:
- CirclIntegrationTest
fromversion: 5.0.0