commonfields:
  id: RDAP
  version: -1
sectionorder:
- Connect
- Collect
name: RDAP
display: RDAP
category: Data Enrichment & Threat Intelligence
provider: Open Source
description: Use the RDAP integration to query domain and IP information.
configuration:
- display: BaseURL
  name: base_url
  type: 0
  required: true
  additionalinfo: The base URL for the RDAP service.
  defaultvalue: https://rdap.org
  section: Connect
  advanced: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  defaultvalue: 'false'
  required: false
- display: Proxy URL
  additionalinfo: "Supports socks4/socks5/http connect proxies (e.g., socks5h://host:1080)."
  name: proxy_url
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Reliability
  name: integrationReliability
  type: 15
  required: true
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  defaultvalue: A - Completely reliable
  additionalinfo: Reliability of the source providing the intelligence data.
  section: Collect
script:
  script: ''
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  commands:
  - name: ip
    arguments:
    - name: ip
      required: true
      description: IP address to query.
      isArray: true
      default: true
    outputs:
    - contextPath: IP.Address
      description: The IP address.
    - contextPath: IP.Description
      description: The IP address description.
    - contextPath: IP.Geo.Country
      description: The IP address geo country.
    - contextPath: IP.Organization.Name
      description: The IP address organization name.
    - contextPath: IP.Registrar.Abuse.Address
      description: The address of the abuse team.
    - contextPath: IP.Registrar.Abuse.Email
      description: The email address of the abuse team.
    - contextPath: IP.Registrar.Abuse.Name
      description: The name of the abuse team.
    - contextPath: RDAP.IP.Value
      description: The queried IP address.
    - contextPath: RDAP.IP.IndicatorType
      description: The type of the indicator (IP).
    - contextPath: RDAP.IP.RegistrarAbuseAddress
      description: The registrar abuse address for the IP.
    - contextPath: RDAP.IP.RegistrarAbuseName
      description: The registrar abuse contact name for the IP.
    - contextPath: RDAP.IP.RegistrarAbuseEmail
      description: The registrar abuse email for the IP.
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
    - contextPath: DBotScore.Type
      description: The indicator type.
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
    - contextPath: DBotScore.Score
      description: The actual score.
    description: Query IP information using RDAP.
  - name: domain
    arguments:
    - name: domain
      required: true
      description: Domain to query.
      isArray: true
    outputs:
    - contextPath: Domain.Name
      description: The domain name.
    - contextPath: Domain.CreationDate
      description: The domain registration date.
    - contextPath: Domain.ExpirationDate
      description: The domain expiration date.
    - contextPath: Domain.WHOIS.CreationDate
      description: The domain registration date.
    - contextPath: Domain.WHOIS.ExpirationDate
      description: The domain expiration date.
    - contextPath: RDAP.Domain.Value
      description: The queried domain name.
    - contextPath: RDAP.Domain.IndicatorType
      description: The type of the indicator (Domain).
    - contextPath: RDAP.Domain.RegistrationDate
      description: The domain registration date.
    - contextPath: RDAP.Domain.ExpirationDate
      description: The domain expiration date.
    - contextPath: RDAP.Domain.LastChangedDate
      description: The last changed date of the domain.
    - contextPath: RDAP.Domain.SecureDNS
      description: Whether the domain uses secure DNS.
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
    - contextPath: DBotScore.Type
      description: The indicator type.
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
    - contextPath: DBotScore.Score
      description: The actual score.
    description: Query domain information using RDAP.

tests:
- No tests
fromversion: 6.10.0