TIM - Process Domains With Whois

This playbook uses several sub playbooks to process and tag indicators based on the results of the Whois tool.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • TIM - Process Domain Age With Whois
  • TIM - Process Domain Registrant With Whois

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

  • whois

Playbook Inputs


NameDescriptionDefault ValueRequired
Indicator QueryIndicators matching the indicator query will be used as playbook inputOptional
CheckForWhoisRegistrantSetting this input as True will run the TIM - Process Domain registrant With Whois playbook.TrueOptional
CheckForWhoisDomainAgeCreationSetting this input as True will run the TIM - Process Domain Creation Age With Whois playbook.TrueOptional

Playbook Outputs


PathDescriptionType
DomainsNotApprovedDomains for which the registrant isn't approved.string
ApprovedRegistrantDomainsDomains for which the registrant is approved.string
DomainsNotResolvedByWhoisDomains Not Resolved By Whois.string
NewDomainsDomains whose create value is after the tested date.string
NotNewDomainsDomains whose create value is before the tested date.string
DomainsNotProcessedDomains that could not be processed for any reason are outputted to this context path.string

Playbook Image


TIM - Process Domains With Whois