Merge pull request #22 from DomainTools/ID-1154-splunk-soar-bug-bash-…

…fixes Revert `domains` text change back to `domain`.
splunk-soar-connectors · Jul 11, 2023 · 7d0511d · 7d0511d
2 parents 6c24139 + c31c75e
commit 7d0511d
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 10 deletions.
diff --git a/domaintools_iris.json b/domaintools_iris.json
@@ -111,7 +111,7 @@
             "identifier": "domain_reputation",
             "read_only": true,
             "parameters": {
-                "domains": {
+                "domain": {
                     "description": "Domain or comma-separated list of domains to query",
                     "data_type": "string",
                     "contains": [
@@ -132,7 +132,7 @@
             },
             "output": [
                 {
-                    "data_path": "action_result.parameter.domains",
+                    "data_path": "action_result.parameter.domain",
                     "data_type": "string",
                     "contains": [
                         "url",
@@ -440,7 +440,7 @@
             "identifier": "reverse_lookup_domain",
             "read_only": true,
             "parameters": {
-                "domains": {
+                "domain": {
                     "description": "Domain or comma-separated list of domains to query",
                     "data_type": "string",
                     "contains": [
@@ -460,7 +460,7 @@
             },
             "output": [
                 {
-                    "data_path": "action_result.parameter.domains",
+                    "data_path": "action_result.parameter.domain",
                     "data_type": "string",
                     "contains": [
                         "url",
@@ -991,7 +991,7 @@
             "identifier": "domain_investigate",
             "read_only": true,
             "parameters": {
-                "domains": {
+                "domain": {
                     "description": "Domain or comma-separated list of domains to query using the Iris Investigate API",
                     "data_type": "string",
                     "contains": [
@@ -1020,7 +1020,7 @@
                     ]
                 },
                 {
-                    "data_path": "action_result.parameter.domains",
+                    "data_path": "action_result.parameter.domain",
                     "data_type": "string",
                     "contains": [
                         "url",
@@ -1667,7 +1667,7 @@
             "identifier": "domain_enrich",
             "read_only": true,
             "parameters": {
-                "domains": {
+                "domain": {
                     "description": "Domain or comma-separated list of domains to query using the Iris Enrich API (if provisioned)",
                     "data_type": "string",
                     "contains": [
@@ -1696,7 +1696,7 @@
                     ]
                 },
                 {
-                    "data_path": "action_result.parameter.domains",
+                    "data_path": "action_result.parameter.domain",
                     "data_type": "string",
                     "contains": [
                         "url",

diff --git a/domaintools_iris_connector.py b/domaintools_iris_connector.py
@@ -315,8 +315,11 @@ def handle_action(self, param):
         self._proxy_url = self._get_proxy_url(config)
 
         # If there is a domains attribute, do tldextract
-        if param.get("domains"):
-            hostnames = param.get("domains").replace(" ", "").strip(",").split(",")
+        # Note: Parameter remained to be named `domain` to avoid
+        # modifying the Playbooks currently being used by customers
+        domains = param.get("domain")
+        if domains:
+            hostnames = domains.replace(" ", "").strip(",").split(",")
             self._domains = self._get_domains(hostnames)
         # If pivoting  and the type is domain, set the query_vca
         if param.get("pivot_type") == "domain":