Skip to main content

Public DNS Feed

Supported versions

Supported Cortex XSOAR versions: 5.5.0 and later.

A feed of known benign IPs of public DNS servers.

Configure Public DNS Feed on Cortex XSOAR#

  1. Navigate to Settings > Integrations > Servers & Services.

  2. Search for Public DNS Feed.

  3. Click Add instance to create and configure a new integration instance.

    ParameterDescriptionRequired
    urlPublic DNS feed URLTrue
    feedFetch indicatorsFalse
    feedReputationIndicator ReputationFalse
    feedReliabilitySource ReliabilityTrue
    feedExpirationPolicyFalse
    feedFetchIntervalFeed Fetch IntervalFalse
    feedExpirationIntervalFalse
    feedTagsTagsFalse
    feedBypassExclusionListBypass exclusion listFalse
    tlp_colorTraffic Light Protocol ColorFalse
    insecureTrust any certificate (not secure)False
    proxyUse system proxy settingsFalse
  4. Click Test to validate the URLs, token, and connection.

Commands#

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

public-dns-get-indicators#


Gets indicators from the feed.

Base Command#

public-dns-get-indicators

Input#

Argument NameDescriptionRequired
limitThe maximum number of results to return. The default value is 10. Default is 10.Optional

Context Output#

There is no context output for this command.

Command Example#

!public-dns-get-indicators limit=2

Context Example#

{
"Indicator": [
{
"rawJSON": {
"type": "IPv6",
"value": "2607:5300:203:1797::53"
},
"score": 0,
"type": "IPv6",
"value": "2607:5300:203:1797::53"
},
{
"rawJSON": {
"type": "Ip",
"value": "199.255.137.34"
},
"score": 0,
"type": "Ip",
"value": "199.255.137.34"
}
]
}

Human Readable Output#

Public DNS Feed:#

valuetype
2607:5300:203:1797::53IPv6
199.255.137.34Ip