DNS
DNS (Domain Name System) is a protocol that translates domain names into IP addresses, enabling communication across the internet.
The Domain Name System (DNS) is a foundational internet service that translates domain names into IP addresses and provides critical network telemetry. The DNS connector for Swimlane Turbine enables automated retrieval of DNS records for any domain and reverse resolution of IP addresses to domain names, all without manual queries or scripting. By integrating DNS data directly into Turbine playbooks, security teams can enrich investigations, accelerate threat detection, and enhance incident response workflows with real-time DNS intelligence. This seamless automation empowers users to quickly identify suspicious domains, map network relationships, and validate indicators of compromise within their security operations.
Capabilities
- Get Records
- Resolve Domain from IP
The Swimlane DNS connector allows you to retrieve DNS records for the following record type:
- TXT
- CNAME
- SOA
- NS
- MX
- CERT
- DNAME
- PTR
- A
- AAAA
- SPF
- SRV
- URL
Considerations
As part of the action, you can specify the default nameserver from which to retrieve DNS records. By default, it uses the default nameservers specified on your Turbine instance.
Actions
Get Records
Obtain DNS records for a specified domain by providing the required domain name as input.
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
domain | string | Required | Parameter for Get Records |
records | string | Optional | Parameter for Get Records |
default_nameservers | string | Optional | Name of the resource |
Input Example
{"domain":"swimlane.com","records":"TXT,A","default_nameservers":"8.8.8.8,8.8.4.4"}
Output
Parameter | Type | Description |
|---|---|---|
TXT | array | Output field: TXT |
CNAME | array | Name of the resource |
SOA | array | Output field: SOA |
NS | array | Output field: NS |
MX | array | Output field: MX |
CERT | array | Output field: CERT |
DNAME | array | Name of the resource |
PTR | array | Output field: PTR |
RP | array | Output field: RP |
A | array | Output field: A |
AAAA | array | Output field: AAAA |
SPF | array | Output field: SPF |
SRV | array | Output field: SRV |
URI | array | Output field: URI |
headers | array | HTTP headers for the request |
headers.file_name | string | HTTP headers for the request |
headers.file | string | HTTP headers for the request |
reason | string | Response reason phrase |
status_code | number | HTTP status code of the response |
Output Example
{"TXT":[],"CNAME":[],"SOA":[],"NS":[],"MX":[],"CERT":[],"DNAME":[],"PTR":[],"RP":[],"A":[],"AAAA":[],"SPF":[],"SRV":[],"URI":[],"headers":[]}
Resolve Domain from IP
Retrieve the domain name linked to a specified IP address using DNS resolution.
Endpoint
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
ip_address | string | Required | IPv4 or IPv6 address to resolve. |
timeout | number | Optional | Timeout in seconds for the DNS lookup (default is 3 seconds). |
Input Example
{"ip_address":"31.13.80.36","timeout":3}
Output
Parameter | Type | Description |
|---|---|---|
primary_hostname | string | Name of the resource |
Output Example
{"primary_hostname":"edge-star-mini-shv-01-yyz1.facebook.com"}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |