SecurityTrails
This Integration is part of the SecurityTrails Pack.#
Supported versions
Supported Cortex XSOAR versions: 6.0.0 and later.
This integration provides API access to the SecurityTrails platform. This integration was integrated and tested with V1 of SecurityTrails
Configure SecurityTrails in Cortex#
| Parameter | Required |
|---|---|
| API Key | True |
| Trust any certificate (not secure) | False |
| Use system proxy settings | False |
| Fetch indicators | False |
Commands#
You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
securitytrails-get-subdomains#
Returns child and sibling subdomains for a given hostname.
Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.
Base Command#
securitytrails-get-subdomains
Input#
| Argument Name | Description | Required |
|---|---|---|
| hostname | The hostname. | Required |
| children_only | Only return children subdomains. Possible values are: true, false. Default is true. | Optional |
Context Output#
| Path | Type | Description |
|---|---|---|
| SecurityTrails.Domain.name | string | Hostname |
| SecurityTrails.Domain.subdomains | unknown | Subdomains |
| Domain.Name | string | Domain name |
| Domain.Subdomains | string | Subdomains |
| SecurityTrails.Domain.subdomain_count | number | Subdomain Count |
Command Example#
Human Readable Output#
securitytrails-get-tags#
Returns tags for a given hostname
Base Command#
securitytrails-get-tags
Input#
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname. | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| SecurityTrails.Domain.name | string | Domain name |
| SecurityTrails.Domain.tags | unknown | Domain tags |
| Domain.Name | string | Domain name |
| Domain.Tags | string | Domain tags |
Command Example#
Human Readable Output#
securitytrails-get-company-associated-ips#
Returns associated IPs for a company domain. The data is based on whois data with the names matched to the domains.
Base Command#
securitytrails-get-company-associated-ips
Input#
| Argument Name | Description | Required |
|---|---|---|
| domain | Domain. | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| SecurityTrails.Domain.name | string | Domain name |
| SecurityTrails.Domain.assocaitedips | unknown | Associated IPs |
| SecurityTrails.Domain.assocaitedip_count | number | Associated IP Count |
Command Example#
Human Readable Output#
securitytrails-get-dns-history#
Lists out specific historical information about the given hostname parameter. In addition of fetching the historical data for a particular type, the count statistic is returned as well, which represents the number of that particular resource against current data.
Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.
Base Command#
securitytrails-get-dns-history
Input#
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname. | Required |
| type | Type. Possible values are: a, aaaa, mx, ns, soa, txt. Default is a. | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| SecurityTrails.Domain.a_history_records.first_seen | string | First seen |
| SecurityTrails.Domain.a_history_records.last_seen | string | Last seen |
| SecurityTrails.Domain.a_history_records.organizations | unknown | Organizations |
| SecurityTrails.Domain.a_history_records.type | string | Type |
| SecurityTrails.Domain.a_history_records.values.ip | string | IP |
| SecurityTrails.Domain.a_history_records.values.ipv6 | string | IPv6 |
| SecurityTrails.Domain.mx_history_records.values.host | string | Host |
| SecurityTrails.Domain.mx_history_records.values.mx_count | number | MX count |
| SecurityTrails.Domain.mx_history_records.values.priority | number | Priority |
| SecurityTrails.Domain.name | string | Name |
| SecurityTrails.Domain.ns_history_records.values.nameserver | string | Name server |
| SecurityTrails.Domain.ns_history_records.values.nameserver_count | number | Name server count |
| SecurityTrails.Domain.soa_history_records.values.email | string | |
| SecurityTrails.Domain.soa_history_records.values.email_count | number | Email count |
| SecurityTrails.Domain.soa_history_records.values.ttl | number | TTL |
| SecurityTrails.Domain.txt_history_records.values.value | string | Value |
| SecurityTrails.Domain.a_history_record_pages | number | A record pages count |
| SecurityTrails.Domain.aaaa_history_record_pages | number | AAAA record pages count |
| SecurityTrails.Domain.mx_history_record_pages | number | MX record pages count |
| SecurityTrails.Domain.ns_history_record_pages | number | NS record pages count |
| SecurityTrails.Domain.soa_history_record_pages | number | SOA record pages count |
| SecurityTrails.Domain.txt_history_record_pages | number | TXT record pages count |
Command Example#
Human Readable Output#
securitytrails-get-ip-neighbors#
Returns the neighbors in any given IP level range and essentially allows you to explore closeby IP addresses. It will divide the range into 16 groups. Example: a /28 would be divided into 16 /32 blocks or a /24 would be divided into 16 /28 blocks
Base Command#
securitytrails-get-ip-neighbors
Input#
| Argument Name | Description | Required |
|---|---|---|
| ipaddress | Starting IP address (optionally with CIDR subnet mask). | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| SecurityTrails.IP.ip | string | IP address |
| SecurityTrails.IP.block.active_egress | boolean | Active Egress |
| SecurityTrails.IP.block.hostnames | string | Hostnames |
| SecurityTrails.IP.block.ports | number | Port |
| SecurityTrails.IP.block.sites | number | Sites |
| IP.Address | string | Address |
Command Example#
Human Readable Output#
securitytrails-statistics-domain#
Domain statistics
Base Command#
securitytrails-statistics-domain
Input#
| Argument Name | Description | Required |
|---|---|---|
| query | The DSL query you want to run (https://docs.securitytrails.com/docs/how-to-use-the-dsl). | Optional |
| filter | JSON dicitonary of filter terms (https://docs.securitytrails.com/reference#domain-search). Can not be used together with query. | Optional |
Context Output#
| Path | Type | Description |
|---|---|---|
| SecurityTrails.Domain.Search.DomainStats.domain_count | number | Domain count |
| SecurityTrails.Domain.Search.DomainStats.hostname_count.relation | string | Relation |
| SecurityTrails.Domain.Search.DomainStats.hostname_count.value | number | Value |
| SecurityTrails.Domain.Search.DomainStats.tld_count | number | TLD count |
| SecurityTrails.Domain.Search.DomainStats.top_organizations.count | number | Count |
| SecurityTrails.Domain.Search.DomainStats.top_organizations.key | string | Key |
| SecurityTrails.Domain.Search.DomainStats.whois_organization_count | number | WHOIS count |
Command Example#
Human Readable Output#
securitytrails-search-ip#
Search for IP addresses. A maximum of 10000 results can be retrieved.
Base Command#
securitytrails-search-ip
Input#
| Argument Name | Description | Required |
|---|---|---|
| page | The page of the returned results, starting at 1. A page returns 100 results. Default is 1. | Optional |
| query | The DSL query you want to run (https://docs.securitytrails.com/docs/how-to-use-the-dsl). | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| SecurityTrails.IP.Search.ip | string | IP Address |
| SecurityTrails.IP.Search.ports.port | number | Port |
| SecurityTrails.IP.Search.ports.date_checked | number | Date checked |
| SecurityTrails.IP.Search.ptr | string | PTR Record |
| IP.Address | string | Address |
| IP.Hostname | string | Hostname |
| IP.Ports | string | Ports |
Command Example#
Human Readable Output#
securitytrails-get-ip-whois#
Returns IPs information based on whois information.
Base Command#
securitytrails-get-ip-whois
Input#
| Argument Name | Description | Required |
|---|---|---|
| ipaddress | IP Address. | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| SecurityTrails.IP.contact_email | string | |
| SecurityTrails.IP.contacts.email | string | |
| SecurityTrails.IP.contacts.organization | string | Organization |
| SecurityTrails.IP.contacts.telephone | string | Telephone |
| SecurityTrails.IP.contacts.type | string | Type |
| SecurityTrails.IP.ip | string | IP |
| SecurityTrails.IP.source | string | Source |
Command Example#
Human Readable Output#
domain#
Provides data enrichment for domains.
Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.
Base Command#
domain
Input#
| Argument Name | Description | Required |
|---|---|---|
| domain | The domain name to enrich. | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| Domain.Name | String | The domain name, for example: "google.com". |
| Domain.DNS | String | A list of IP objects resolved by DNS. |
| Domain.DomainStatus | Datte | The status of the domain. |
| Domain.NameServers | Unknown | (List<String>) Name servers of the domain. |
| Domain.Organization | String | The organization of the domain. |
| Domain.Subdomains | Unknown | (List<String>) Subdomains of the domain. |
| Domain.Admin.Country | String | The country of the domain administrator. |
| Domain.Admin.Email | String | The email address of the domain administrator. |
| Domain.Admin.Name | String | The name of the domain administrator. |
| Domain.Admin.Phone | String | The phone number of the domain administrator. |
| Domain.Registrant.Country | String | The country of the registrant. |
| Domain.Registrant.Email | String | The email address of the registrant. |
| Domain.Registrant.Name | String | The name of the registrant. |
| Domain.Registrant.Phone | String | The phone number for receiving abuse reports. |
| Domain.Tags | Unknown | (List) Tags of the domain. |
| Domain.WHOIS.DomainStatus | String | The status of the domain. |
| Domain.WHOIS.NameServers | String | (List<String>) Name servers of the domain. |
| Domain.WHOIS.CreationDate | Date | The date that the domain was created. |
| Domain.WHOIS.UpdatedDate | Date | The date that the domain was last updated. |
| Domain.WHOIS.ExpirationDate | Date | The expiration date of the domain. |
| Domain.WHOIS.Registrant.Name | String | The name of the registrant. |
| Domain.WHOIS.Registrant.Email | String | The email address of the registrant. |
| Domain.WHOIS.Registrant.Phone | String | The phone number of the registrant. |
| Domain.WHOIS.Registrar.Name | String | The name of the registrar, for example: `GoDaddy` |
| Domain.WHOIS.Registrar.Email | String | The email address of the contact. |
| Domain.WHOIS.Registrar.Phone | String | The phone number of contact. |
| Domain.WHOIS.Admin.Name | String | The name of the domain administrator. |
| Domain.WHOIS.Admin.Email | String | The email address of the domain administrator. |
| Domain.WHOIS.Admin.Phone | String | The phone number of the domain administrator. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Score | Number | The actual score. |
Command Example#
Human Readable Output#
securitytrails-sql-get-next#
Retrieves the next page of results returned from a SQL query where the results exceeded the last page.
Base Command#
securitytrails-sql-get-next
Input#
| Argument Name | Description | Required |
|---|---|---|
| id | The ID to use to retrieve the next page of results. Possible values are: . | Required |
| timeout | Read timeout for calls (default is 20 seconds). Possible values are: . Default is 20. | Optional |
Context Output#
| Path | Type | Description |
|---|---|---|
| Securitytrails.SQL.total | number | The total number of hits discovered |
| Securitytrails.SQL.records | unknown | The records returned |
| Securitytrails.SQL.id | string | The ID to use for further GET calls to retrieve more results |
| Securitytrails.SQL.query | string | The original query used |