Publisher: Splunk
Connector Version: 2.0.6
Product Vendor: Mnemonic
Product Name: Passive DNS
Product Version Supported (regex): ".*"
Minimum Product Version: 5.1.0
This app integrates with the Mnemonic Passive DNS API to implement investigative actions
The below configuration variables are required for this Connector to operate. These variables are specified when configuring a Passive DNS asset in SOAR.
| VARIABLE | REQUIRED | TYPE | DESCRIPTION |
|---|---|---|---|
| domain | optional | string | Domain to check connectivity (Default: phantom.us) |
test connectivity - Validate the asset configuration for connectivity using supplied configuration
lookup domain - Check for the presence of a domain in a threat intelligence feed
Validate the asset configuration for connectivity using supplied configuration
Type: test
Read only: True
No parameters are required for this action
No Output
Check for the presence of a domain in a threat intelligence feed
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| domain | required | Domain to lookup | string | domain url |
| range | optional | Range (min_offset-max_offset), default is 0-100 | string |
| DATA PATH | TYPE | CONTAINS |
|---|---|---|
| action_result.status | string | |
| action_result.parameter.domain | string | domain url |
| action_result.parameter.range | string | |
| action_result.data.*.answer | string | ip |
| action_result.data.*.createdTimestamp | numeric | |
| action_result.data.*.customer | string | |
| action_result.data.*.firstSeenTimestamp | numeric | |
| action_result.data.*.firstSeenTimestampString | string | |
| action_result.data.*.lastSeenTimestamp | numeric | |
| action_result.data.*.lastSeenTimestampString | string | |
| action_result.data.*.lastUpdatedTimestamp | numeric | |
| action_result.data.*.maxTtl | numeric | |
| action_result.data.*.minTtl | numeric | |
| action_result.data.*.query | string | |
| action_result.data.*.rrclass | string | |
| action_result.data.*.rrtype | string | |
| action_result.data.*.times | numeric | |
| action_result.data.*.tlp | string | |
| action_result.summary.items_returned | numeric | |
| action_result.summary.total_items | numeric | |
| action_result.message | string | |
| summary.total_objects | numeric | |
| summary.total_objects_successful | numeric |