Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The CIRCL Passive DNS operation for ThreatQ allows users to query the CIRCL Passive DNS database for selected indicators in the ThreatQ Threat Library.

The operation provides the following action:

• Query CIRCL Passive DNS - queries the Query CIRCL Passive DNS database for FQDN and IP Address indicator sub-types.

The operation is compatible with the following indicator types:

• FQDN
• IP Address

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Operation option from the Type dropdown (optional).
3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   Hostname/IP Address of the CIRCL server	The hostname or IP address of the Circl instance.  The system default is for the cloud offering: global.cloud.Circl.com.
   Communication Port	Optional - Enter the user port used for communication with CIRCL.
   User Token	Your User Token for authentication.
   Use HTTP	Enable this option to use HTTP protocol when connecting to CIRCL.
   Verify SSL	Enable this option to verify the SSL when connecting to CIRCL.

5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

Actions

The operation provides the following action:

{
  "count": 6,
  "origin": "https://www.circl.lu/pdns/",
  "time_first": 1496995637,
  "rrtype": "A",
  "rrname": "www.threatq.com",
  "rdata": "104.196.175.197",
  "time_last": 1499951111
}{
  "count": 3,
  "origin": "https://www.circl.lu/pdns/",
  "time_first": 1495523983,
  "rrtype": "NS",
  "rrname": "threatsketch.com",
  "rdata": "dns04.gpn.register.com",
  "time_last": 1495533768
}{
  "count": 3,
  "origin": "https://www.circl.lu/pdns/",
  "time_first": 1495523983,
  "rrtype": "NS",
  "rrname": "threatsketch.com",
  "rdata": "dns01.gpn.register.com",
  "time_last": 1495533768
}{
  "count": 3,
  "origin": "https://www.circl.lu/pdns/",
  "time_first": 1495523983,
  "rrtype": "NS",
  "rrname": "threatsketch.com",
  "rdata": "dns02.gpn.register.com",
  "time_last": 1495533768
}{
  "count": 3,
  "origin": "https://www.circl.lu/pdns/",
  "time_first": 1495523983,
  "rrtype": "NS",
  "rrname": "threatsketch.com",
  "rdata": "dns05.gpn.register.com",
  "time_last": 1495533768
}{
  "count": 3,
  "origin": "https://www.circl.lu/pdns/",
  "time_first": 1495523983,
  "rrtype": "NS",
  "rrname": "threatsketch.com",
  "rdata": "dns03.gpn.register.com",
  "time_last": 1495533768
}{
  "count": 5,
  "origin": "https://www.circl.lu/pdns/",
  "time_first": 1495523983,
  "rrtype": "A",
  "rrname": "threatsketch.com",
  "rdata": "104.196.175.197",
  "time_last": 1495533768
}

Change Log

• Version 1.0.0
  • Initial release