mirror of https://github.com/MISP/misp-modules
10 lines
1.5 KiB
JSON
10 lines
1.5 KiB
JSON
{
|
|
"description": "Module to access Farsight DNSDB Passive DNS.",
|
|
"logo": "logos/farsight.png",
|
|
"requirements": ["An access to the Farsight Passive DNS API (apikey)", "The dnsdb2 python library"],
|
|
"input": "A domain, hostname or IP address MISP attribute.",
|
|
"output": "Passive-dns objects, resulting from the query on the Farsight Passive DNS API.",
|
|
"references": ["https://www.farsightsecurity.com/", "https://docs.dnsdb.info/dnsdb-api/"],
|
|
"features": "This module takes a domain, hostname or IP address MISP attribute as input to query the Farsight Passive DNS API. \nThe results of rdata and rrset lookups are then returned and parsed into passive-dns objects.\n\nAn API key is required to submit queries to the API. \nIt is also possible to define a custom server URL, and to set a limit of results to get. \nThis limit is set for each lookup, which means we can have an up to the limit number of passive-dns objects resulting from an rdata query about an IP address, but an up to the limit number of passive-dns objects for each lookup queries about a domain or a hostname (== twice the limit).\n\nAdditionally to the lookup queries, responses from flex queries can be returned with the results. \nTo get this additional data with the results, there is a `flex_queries` configuration parameter to set to `true`. The module submit then regex queries to the API, using the domain, hostname or IP address as keyword for the search. Passive-dns objects are returned next to the ones resulting from the lookup queries."
|
|
}
|