Farsight DNSDB Operation
The web format of this guide reflects the most current release. Guides for older iterations are available in PDF format.
Integration Details
ThreatQuotient provides the following details for this integration:
| Current Integration Version | 1.0.4 |
| Compatible with ThreatQ Versions | >= 4.0.0 |
| Support Tier | ThreatQ Supported |
Introduction
The Farsight DNSDB operation allows you to ingest enrichment data, such as verified DNS, from DNSDB.
The operation provides the following actions:
- Get Domain History - retrieves resolution history.
- Get Domain Info - retrieves history and related domains.
- Get Domains Associated to Nameserver - retrieves domain names delegated to the nameserver.
- Get CIDR Domain History - retrieves RDATA data for CIDR Blocks.
The operation is compatible with the following indicator types:
- CIDR Block
- FDQN
- IP Address
Installation
This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.
Configuration
ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.
To configure the integration:
- Navigate to your integrations management page in ThreatQ.
- Select the Operation option from the Type dropdown (optional).
- Click on the integration entry to open its details page.
- Enter the following parameter under the Configuration tab:
Parameter Description Farsight DNSDB API Key Your Farsight DNSDB API Key.
- Review any additional settings, make any changes if needed, and click on Save.
- Click on the toggle switch, located above the Additional Information section, to enable it.
Actions
The operation provides the following actions:
| Action | Description | Object Type | Object Subtype |
|---|---|---|---|
| Get Domain History | Get Resolution History. | Indicator | IP Address |
| Get Domain Info | Get resolution history and related domains. | Indicator | FQDN |
| Get Domain Associated to Nameserver | Get domain names delegated to the nameserver. | Indicator | FQDN |
| Get CIDR Domain History | Get RDATA data for CIDR Block. | Indicator | CIDR Block |
Change Log
- Version 1.0.4
- Initial release
PDF Guides
| Document | ThreatQ Version |
|---|---|
| Farsight DNSDB Operation Guide v1.0.4 | 4.0.0 or Greater |