Skip to main content

TIM - Process Domains With Whois

This Playbook is part of the Whois Pack.#

Supported versions

Supported Cortex XSOAR versions: 5.5.0 and later.

This playbook uses several sub playbooks to process and tag indicators based on the results of the Whois tool.


This playbook uses the following sub-playbooks, integrations, and scripts.


  • TIM - Process Domain Age With Whois
  • TIM - Process Domain Registrant With Whois


This playbook does not use any integrations.


This playbook does not use any scripts.


  • whois

Playbook Inputs#

NameDescriptionDefault ValueRequired
Indicator QueryIndicators matching the indicator query will be used as playbook inputOptional
CheckForWhoisRegistrantSetting this input as True will run the TIM - Process Domain registrant With Whois playbook.TrueOptional
CheckForWhoisDomainAgeCreationSetting this input as True will run the TIM - Process Domain Creation Age With Whois playbook.TrueOptional

Playbook Outputs#

DomainsNotApprovedDomains for which the registrant isn't approved.string
ApprovedRegistrantDomainsDomains for which the registrant is approved.string
DomainsNotResolvedByWhoisDomains Not Resolved By Whois.string
NewDomainsDomains whose create value is after the tested date.string
NotNewDomainsDomains whose create value is before the tested date.string
DomainsNotProcessedDomains that could not be processed for any reason are outputted to this context path.string

Playbook Image#

TIM - Process Domains With Whois