versionedfields: {}
commonfields:
  id: DomainTools
  version: -1
name: DomainTools
fromversion: 5.0.0
display: DomainTools (Deprecated)
category: Data Enrichment & Threat Intelligence
provider: DomainTools
description: Deprecated. Use DomainTools Iris Pack instead.
configuration:
- display: DomainTools API URL
  name: server
  defaultvalue: http://api.domaintools.com/
  type: 0
  required: true
- display: API Username
  displaypassword: API Key
  name: credentials
  type: 9
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: API Key (Deprecated)
  hidden: true
  name: key
  defaultvalue: ""
  type: 4
  required: false
- display: API Username
  name: username
  defaultvalue: ""
  type: 0
  hidden: true
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: domain
    arguments:
    - name: domain
      required: true
      description: Domain name to check reputation.
      default: true
    - name: long
      description: Should we return full response with detected URLs.
    - name: sampleSize
      description: The number of samples from each type (resolutions, detections, etc.) to display for long format.
    - name: threshold
      description: 'If number of positive detected domains is bigger than the threshold we will consider it malicious.'
    - name: wait
      description: Wait time between tries if we reach the API rate limit in seconds.
    - name: retries
      description: Number of retries for API rate limit.
    outputs:
    - contextPath: Domain.Name
      description: The tested domain.
    - contextPath: Domain.RiskScore
      description: The reputation returned from DomainTools.
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domains, the vendor that made the decision.
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
    - contextPath: DBotScore.Type
      description: The indicator type.
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
    - contextPath: DBotScore.Score
      description: The actual score.
    description: Retrieve domain information.
    deprecated: true
  - name: domainSearch
    arguments:
    - name: query
      required: true
      default: true
      description: (mandatory and default) Query strings. Each term in the query string must be at least three characters long. Use spaces to separate multiple terms.
    - name: pageNumber
      description: 'Sets the page of results to retrieve from the server. Each page is limited to 100 results. Default: 1.'
      defaultValue: "1"
    - name: maxLength
      description: 'Limit the maximum domain character count. Default: 25.'
      defaultValue: "25"
    - name: minLength
      description: 'Limit the minimum domain character count. Default: 1.'
      defaultValue: "1"
    - name: hesHyphen
      description: '(true or false) Return results with hyphens in the domain name. Default: true.'
    - name: exclude
      description: Terms to exclude from matching.
    - name: activeOnly
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: '(true or false) Return only domains currently registered.Default: false.'
      defaultValue: "false"
    - name: deletedOnly
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: '(true or false) Return only domains previously registered but not currently registered. Default: false.'
      defaultValue: "false"
    - name: anchorLeft
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: '(true or false) Return only domains that start with the query term. Default: false.'
      defaultValue: "false"
    - name: anchorRight
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: '(true or false) Return only domains that end with the query term. Default: false.'
      defaultValue: "false"
    - name: hasNumber
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: '(true or false) Return results with numbers in the domain name. Default: true.'
      defaultValue: "true"
    outputs:
    - contextPath: Domain.Name
      description: Domain found by command.
    description: Search for domain based on the given parameters.
    deprecated: true
  - name: reverseIP
    arguments:
    - name: ip
      default: true
      description: (default) specify IP address.
    - name: domain
      description: 'If you provide a domain name, DomainTools will respond with the list of other domains that share the same IP.'
    - name: limit
      description: Limits the size of the domain list than can appear in a response. The limit is applied per-IP address, not for the entire request.
    outputs:
    - contextPath: Domain.Name
      description: Domain name.
    - contextPath: Domain.DNS.Address
      description: IP address.
    description: Reverse loopkup of an IP address.
    deprecated: true
  - name: reverseNameServer
    arguments:
    - name: nameServer
      required: true
      default: true
      description: '(default and mandatory) specify the name of the primary or secondary name server.'
    - name: limit
      description: Limit the size of the domain list than can appear in a response.
    outputs:
    - contextPath: Domain.Name
      description: Name of domain.
    description: Reverse nameserver lookup.
    deprecated: true
  - name: reverseWhois
    arguments:
    - name: terms
      required: true
      default: true
      description: '(mandatory and default) List of one or more terms to search for in the Whois record, separated with the pipe character ( | ).'
    - name: exclude
      description: Domain names with Whois records that match these terms will be excluded from the result set. Separate multiple terms with the pipe character ( | ).
    - name: onlyHistoricScope
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Show only historic records.
      defaultValue: "false"
    - name: quoteMode
      description: 'Only lists the size and retail price of the query if you have per-domain pricing access purchase : includes the complete list of domain names that match the query.'
      defaultValue: purchase
    outputs:
    - contextPath: Domain.Name
      description: Name of domain.
    description: Reverse lookup of whois information.
    deprecated: true
  - name: whois
    arguments:
    - name: query
      required: true
      default: true
      description: '(mandatory and default) enter domain (do not use full URL). e.g. !whois [query=]demisto.com.'
    - name: parsed
      description: Should return parsed or raw response. Default is true.
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      defaultValue: "true"
    outputs:
    - contextPath: Domain.Name
      description: Requested domain name.
    - contextPath: Domain.Whois
      description: Whois data.
    description: Provides registration details about a domain.
    deprecated: true
  - name: whoisHistory
    arguments:
    - name: domain
      required: true
      default: true
      description: Specify domain e.g. mycompany.com.
    outputs:
    - contextPath: Domain.Name
      description: Name of domain.
    - contextPath: Domain.WhoisHistory
      description: Domain Whois history data.
    description: Display a history of whois for a given domain.
    deprecated: true
  - name: domainProfile
    description: Display profile for a given domain.
    arguments:
    - name: domain
      description: Specify domain e.g. mycompany.com.
    deprecated: true
deprecated: true
tests:
- No tests (deprecated)