Domain Squatting
Domain Squatting helps organizations monitor and manage potential domain squatting threats by identifying and responding to suspicious domain registrations.
Domain Squatting is a critical security service that identifies and mitigates the risks associated with domain squatting. This connector enables Swimlane Turbine users to automate the detection, analysis, and response to potential squatting domains. By integrating with Domain Squatting, users can efficiently monitor domain activities, compare current and historical data, and take swift action to deactivate or refresh domain records. This integration enhances security operations by providing real-time insights and automated responses to potential threats, reducing the risk of brand impersonation and phishing attacks.
Prerequisites
Before you can use the Domain Squatting connector for Turbine, you'll need access to the necessary authentication mechanisms. This requires the following:
- HTTP Basic Authentication using the following parameters:
- Swimlane URL: The URL endpoint for accessing Swimlane services.
- Swimlane Username: Your username for authenticating with Swimlane.
- Swimlane Password: Your password for authenticating with Swimlane.
- API Key Authentication using the following parameters:
- Swimlane URL: The URL endpoint for accessing Swimlane services.
- Swimlane API/Admin PAT: Personal Access Token for API authentication.
Capabilities
This connector provides the following capabilities:
- Check associated threat intelligence records reputation results
- Compare current and previous DOM hashes
- Create & erase snapshot records
- Deactivate all potential squatting domain records
- Find potential squatting domains
- Refresh potential squatting domains
- Retrieve associated monitored domain and threat intelligence records
Initial Setup
You will need:
- A Swimlane Administrator/API User Personal Access Token (PAT)
- Domain Squatting application(s) deployed to a Swimlane instance
- Domain Squatting: Monitored Domain
- Domain Squatting: Potential Squatting Domain
- Domain Squatting: Snapshot
- Quickstart Application(s)
- Threat Intel - Indicators and Artifacts
Note: Field names, etc. are case sensitive. Please enter just as you see in this documentation, or if using other field names, pay close attention to case sensitivity throughout setup.
Required Assets
Swimlane Alert Correlation
- Swimlane URL: "sw-web:443" on SPI installations, "sw-web:4443" on Docker installations
- Swimlane API/Admin PAT: Personal Access Token (PAT) of an Administrative or API user
Task Details
There are several different tasks within this connector which are specifically tailored to work with the Domain Squatting set of applications (e.g. Use Case). To help facilitate any troubleshooting or questions about this connector we have described each task as well as how it is used in connection with the Domain Squatting set of applications.
Find Potential Squatting Domains
The Find Potential Squatting Domains task utilizes dominions (an open-source project developed by the Swimlane Deep Dive team). dominions is a Python package that searches WhoisDS for newly registered domains. dominions accepts a domain name as input and performs three different algorithms and checks this against newly registered domains:
- contained_in - Checks to see if the domain is contained within a newly registered domain.
- levenshtein - Checks the Levenshtein Distance the provided domain is to a newly registered domain.
- confusables - Checks to see if the domain contains confusables that match a newly registered domain.
The following inputs for this task are defined below:
- Monitored Domain Application Name (str): The string name of the monitored domain application within Swimlane. Default is Domain Squatting: Monitored Domain
- Domain To Monitor Field Display Name (str): The field display name that represents the Domain to Monitor. Default is Domain to Monitor
- Search Active Field Display Name (str): The field display name that represents whether a search is active or not. Default is Search Active
- Maximum Potential Squatting Domains Per Day Field Display Name (str, optional): The field display name that represents the maximum potential squatting domains that should be identified for a given domain. Default is Maximum Potential Squatting Domains Per Day
This task will output the following:
- Potential Squatting Domain (str): The potential squatting domain from the Domain To Monitor Field Display Name field.
- Monitored Domain Record ID (str): The potential squatting domain Swimlane application record ID.
- Matched Domain (str): A matched domain
- Search Term (str): The search term that identified the matched domain.
- Search Term Match Methods (list): All match methods. Options include contained_in,levenshtein, and confusables
Refresh Active Potential Squatting Domains
The Refresh Active Potential Squatting Domains task periodically runs and runs patch (update) on any Potential Squatting Domain records status field to Preparing for Submission which will in turn kick off workflow within that application record.
The following inputs for this task are defined below:
- Potential Squatting Domain Application Name (str): The string name of the potential squatting domain application within Swimlane. Default is Domain Squatting: Potential Squatting Domain
- Scan Active Field Display Name (str): The field display name that represents whether there is an active scan on a record. Default is Scan Active
- Status Field Display Name (str): The field display name that represents the current status for a potential squatting domain record. Default is Status
- Target Status Field Display Name (str): The status to set within all potential squatting domain recods. Default is Preparing for Submission
This task will output the following:
- Success (bool): Whether the task was successful.
- Errors (str): Errors if they occured when running the task.
- Completed (datetime): An ISO8601 date timestamp when the task was completed.
- Records Refreshed (list): A list of records refreshed.
Check Threat Intelligence Reputation
The Check Threat Intelligence Reputation task is triggered via workflow to check a Threat Intel - Indicators and Artifacts application for any associated IOCs.
The following inputs for this task are defined below:
- Landing Page Threat Intelligence Reference Record Display Name (str): The field display name that represents the a reference record containing a potential squatting domains landing page record. Default is Landing Page Threat Intelligence Records
- Langing Page Threat Intelligence Reference Record Verdict Field Display Name (str): The field display name that represents the verdict for the provided Landing Page Threat Intelligence Reference Record Display Name reference record. Default is TI Tag
- Associated IOC Threat Intelligence Reference Record Display Name (str): The field display name that represents any associated threat intelligence via a Associated IOC reference record. Default is Associated IOC Threat Intelligence Records
- Associated IOC Threat Intelligence Reference Record Verdict Field Display Name (str): The field display name that represents the verdict for the provided Associated IOC Threat Intelligence Reference Record Display Name reference record. Default is TI Tag
This task will output the following:
- Current Landing Page Verdict (str): The current landing page verdict (e.g. Malicious, Suspicious, etc.)
- Current Associated IOC Verdict (str): The current associated IOC verdict (e.g. Malicious, Suspicious, etc.)
- Current Automated Verdict (str): The current overall automated verdict (e.g. Malicious, Suspicious, etc.)
- Completed (datetime): An ISO8601 date timestamp when the task was completed.
Compare Current DOM Hashes to Previous DOM Hashes
The Compare Current DOM Hashes to Previous DOM Hashes task is triggered via workflow and compares the current DOM hash to all previous DOM hashes.
The following inputs for this task are defined below:
- Most Recent DOM (str): The most recent captured DOM string.
- Previous DOM Fuzzy Hashes (str): All previous DOM fuzzy hashes.
- Snapshot Match Threshold (int, optional). The snapshot threshold for matching current DOM to previous DOMs. Default is 75.
This task will output the following:
- Previous DOM Fuzzy Hashes (list): An updated list of DOM fuzzy hashes from current plus previous DOM hashes.
- Create New Snapshot Record (bool): Whether or not to create a new snaphsot record.
- Most Recent DOM Fuzzy Hash (str): The most recent DOM fuzzy hash.
- Max Match Percentage (int): The maximum TLSH match percentage identified.
Create Snapshot Record from Current Snapshot
The Create Snapshot Record from Current Snapshot task is triggered via workflow and creates a Snapshot record using the current record data. This task is essentially a pass through that takes inputs you've defined and outputs them so you can create a new record in the Snapshot application. The only addition is the Completed timestamp field is added as an output.
There are several inputs for this task (too many to list out here) and all are optional but we recommend that you use as many as possible for your application.
Deactivate All Potential Squatting Domains
The Deactivate All Potential Squatting Domains task is used to deactivate all potential squatting domains within the Monitored Domain application.
The following inputs for this task are defined below:
- Potential Squatting Domains Display Name (str): The field display name that represents a potential squatting domain(s) within Monitored Domain records. Default is Potential Squatting Domains
- Scan Active Field Display Name (str): The field display name that represents whether there is an active scan on a record. Default is Scan Active
This task will output the following:
- Deactivation Status (str): The deactivation status.
- Completed (datetime): An ISO8601 date timestamp when the task was completed.
Erase Current Snapshot Info
The Erase Current Snapshot Info task is triggered via a widget/button and will erase data from provided fields within a Snapshot record.
The following inputs for this task are defined below:
- Field Names (list): The field display name(s) to erase data from. Default is Most Recent URLScan DOM, Most Recent URLScan JSON, URLScan Most Recent UUID, URLScan Result, URLScan Message, Create New Snapshot Record, Most Recent Status Code, Requests, Certificates, Domains Contacted, Countries Contacted, IPs Contacted, Link Domains, Servers Contacted, URLs Requested,Final URL, Links, Current Indicators, Current Landing Page Verdict, Current Associated IOC Verdict, Current Automated Verdict, Landing Page Submitted to Threat Intelligence, Associated IOCs Submitted to Threat Intelligence, Max Match Percentage, Most Recent URLScan Screenshot Attachment, Associated IOC Threat Intelligence Records
Most Recent URLScan DOM, Most Recent URLScan JSON, URLScan Most Recent UUID, URLScan Result, URLScan Message, Create New Snapshot Record, Most Recent Status Code, Requests, Certificates, Domains Contacted, Countries Contacted, IPs Contacted, Link Domains, Servers Contacted, URLs Requested,Final URL, Links, Current Indicators, Current Landing Page Verdict, Current Associated IOC Verdict, Current Automated Verdict, Landing Page Submitted to Threat Intelligence, Associated IOCs Submitted to Threat Intelligence, Max Match Percentage, Most Recent URLScan Screenshot Attachment, Associated IOC Threat Intelligence RecordsThis task will output the following:
- Success (bool): Whether the task was successful.
- Errors (str): Errors if they occured when running the task.
- Completed (datetime): An ISO8601 date timestamp when the task was completed.
Retrieve Associated Monitored Domain Record
The Retrieve Associated Monitored Domain Record retrieves all associated monitored domain records within the Potential Squatting Domain application.
The following inputs for this task are defined below:
- Reference Field Display Name (str): The field display name that represents reference record of monitored domains. Default is Monitored Domains
- Reference Field ID Display Name (str): The field display name that represents the monitored domain record ID. Default is Monitored Domain Record ID
This task will output the following:
- Success (bool): Whether the task was successful.
- Errors (str): Errors if they occured when running the task.
- Completed (datetime): An ISO8601 date timestamp when the task was completed.
Retrieve Associated Threat Intelligence Records
The Retrieve Associated Threat Intelligence Records retrieves all associated threat intelligence records on a potential squatting domain.
The following inputs for this task are defined below:
- Landing Page Threat Intelligence Field Display Name (str): The field display name that represents the a reference record containing a potential squatting domains landing page record. Default is Landing Page Threat Intelligence Records
- Landing Page Record IDs (list): A mapped field that contains a list of Landing Page Record IDs
- Associated IOC Threat Intelligence Reference Record Display Name (str): The field display name that represents any associated threat intelligence via a Associated IOC reference record. Default is Associated IOC Threat Intelligence Records
- Associated IOC Record IDs (list): A mapped field that contains a list of associated IOC record IDs
This task will output the following:
- Completed (datetime): An ISO8601 date timestamp when the task was completed.
Configurations
API Key Authentication
Authenticates using an API Key
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | Internal URL of your Swimlane Instance, i.e. 'sw-web:443', 'sw-web:4443' or FQDN of Load Balancer. | string | Required |
swimlane_api_pat | Personal Access Token (PAT) for an API/Administrative user of Swimlane. | string | Required |
account_id | Account ID for multi-tenant environments. Required for multi-tenant mode (must be used with Tenant ID). | string | Optional |
tenant_id | Tenant ID for multi-tenant environments. Required for multi-tenant mode (must be used with Account ID). | string | Optional |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
HTTP Basic Authentication
Authenticates using username and password.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | Internal URL of your Swimlane Instance, i.e. 'sw-web:443', 'sw-web:4443' or FQDN of Load Balancer. | string | Required |
username | Username for an API/Administrative user of Swimlane. Use with password as an alternative to API/Admin PAT. | string | Required |
password | Password for an API/Administrative user of Swimlane. Use with username as an alternative to API/Admin PAT. | string | Required |
account_id | Account ID for multi-tenant environments. Required for multi-tenant mode (must be used with Tenant ID). | string | Optional |
tenant_id | Tenant ID for multi-tenant environments. Required for multi-tenant mode (must be used with Account ID). | string | Optional |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Check Threat Intelligence Reputation
Checks a squatting domain against a Threat Intelligence application using specified ApplicationId and RecordId.
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
landing_page_threat_intelligence_reference_display_name | string | Required | The display name of the landing page threat intelligence reference record. |
landing_page_threat_intelligence_reference_verdict_field_display_name | string | Required | The display name of the landing page threat intelligence reference record verdict field. |
associated_ioc_threat_intelligence_reference_display_name | string | Required | The display name of the associated IOC threat intelligence reference record. |
associated_ioc_threat_intelligence_reference_verdict_field_display_name | string | Required | The display name of the associated IOC threat intelligence reference record verdict field. |
ApplicationId | string | Required | The ID of the application to check the threat intelligence reputation of. |
RecordId | string | Required | The ID of the record to check the threat intelligence reputation of. |
Input Example
{"landing_page_threat_intelligence_reference_display_name":"Landing Page Threat Intelligence Records","landing_page_threat_intelligence_reference_verdict_field_display_name":"TI Tag","associated_ioc_threat_intelligence_reference_display_name":"Associated IOC Threat Intelligence Records","associated_ioc_threat_intelligence_reference_verdict_field_display_name":"TI Tag","ApplicationId":"aBLmK0zmAm8gfUY1A","RecordId":"aBLmK0zmAm8gfUY1A"}
Output
Parameter | Type | Description |
|---|---|---|
landing_page | string | Output field: landing_page |
associated_ioc | string | Output field: associated_ioc |
verdict | string | Output field: verdict |
completed | string | Output field: completed |
Output Example
{"landing_page":"Current Landing Page Verdict","associated_ioc":"Current Associated IOC Verdict","verdict":"Current Automated Verdict","completed":"Tue, 24 Oct 2023 06:28:56 GMT"}
Compare Current DOM Text to Previous DOM Hashes
Compare the current DOM text to previously captured DOM SSDeep hashes using Domain Squatting. Requires most_recent_dom and previous_fuzzy_hashes inputs.
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
most_recent_dom | string | Required | The most recent DOM. |
previous_fuzzy_hashes | array | Required | Previous DOM fuzzy hashes |
snapshot_match_threshold | number | Optional | SSDeep Snapshot match threshold (percentage). |
Input Example
{"most_recent_dom":"<html></html>","previous_fuzzy_hashes":["6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezocKqD:J0+oxBeRmR9etdzRxGez1T"],"snapshot_match_threshold":91}
Output
Parameter | Type | Description |
|---|---|---|
previous_dom_fuzzy_hashes | array | Output field: previous_dom_fuzzy_hashes |
create_new_snapshot_record | boolean | Output field: create_new_snapshot_record |
most_recent_dom_fuzzy_hash | string | Output field: most_recent_dom_fuzzy_hash |
max_match_percentage | number | Output field: max_match_percentage |
Output Example
{"previous_dom_fuzzy_hashes":["Previous DOM Fuzzy Hashes"],"create_new_snapshot_record":true,"most_recent_dom_fuzzy_hash":"Most Recent DOM Fuzzy Hash","max_match_percentage":3}
Create Snapshot Record from Current Snapshot
Create a new record in the Domain Squatting Snapshot application using the current snapshot of a potential squatting domain.
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
screenshot_attachment | string | Optional | Screenshot Attachment File. |
most_recent_dom | string | Optional | The most recent DOM. |
urlscan_result | string | Optional | URLScan Result. |
json | string | Optional | Most recent URLScan Json. |
requests | string | Optional | HTTP requests data. |
certificates | string | Optional | Certificate data. |
domains_contacted | array | Optional | Domains contacted. |
countries_contacted | array | Optional | Countries contacted. |
ips_contacted | array | Optional | IPs contacted. |
link_domains | array | Optional | Link domains. |
servers_contacted | array | Optional | Servers contacted. |
urls_requested | array | Optional | URLs requested. |
most_recent_dom_fuzzy_hash | string | Optional | Most recent DOM fuzzy hash. |
final_url | string | Optional | Final URL. |
potential_squatting_domain | string | Required | Potential squatting domain. |
automated_verdict | string | Optional | Current automated verdict. |
landing_page_verdict | string | Optional | Current landing page verdict. |
associated_ioc_verdict | string | Optional | Current associated IOC verdict. |
analyst_verdict | string | Optional | Analyst verdict. |
customer | string | Optional | Customer. |
search_term | string | Optional | Search term. |
search_term_match_methods | array | Optional | Search term match methods. |
whois_information | string | Optional | WHOIS information. |
max_match_percentage | number | Optional | Maximum match percentage. |
most_recent_status_code | string | Optional | Most recent status code. |
Input Example
{"screenshot_attachment":"Swimlane Attachment","most_recent_dom":"<html></html>","urlscan_result":"<html></html>","json":"[{'requests': []}]","requests":"[{'requests': []}]","certificates":"[{'requests': []}]","domains_contacted":["go.microsoft.com, api.okta.com"],"countries_contacted":["United States, China"],"ips_contacted":["1.2.3.4,123.123.123.123"],"link_domains":["swimlane.com, google.com"],"servers_contacted":["Apache, Microsoft-IIS/10.0"],"urls_requested":["https://swimlane.com, https://google.com"],"most_recent_dom_fuzzy_hash":"1536:KcVCFHMzjwhAWlWAWfWLWhVLvL/iyuLyEIheFoceBkUq6L0z4KjPJXzzZImtNAzr:KcCp5bMC1E+4oRzoCW","final_url":"https://swimlane.com","potential_squatting_domain":"sw1mlan3.com","automated_verdict":"Malicious","landing_page_verdict":"Suspicious","associated_ioc_verdict":"Benign","analyst_verdict":"Malicious","customer":"Swimlane","search_term":"google.com","search_term_match_methods":["levenshtein, contained_in"],"whois_information":"Domain Name: LOGINMICROSOFTONLINECOMCOMNOAUTTHORIZE.XYZ\nRegistry Domain ID: D239882803-CNIC\nRegistrar WHOIS Server: whois.namesilo.com","max_match_percentage":75,"most_recent_status_code":"204","landing_page_threat_intelligence_records":["5b6887bfa7772fa3692516af, 5b6887c09a6cf142fc3824f7"],"associated_ioc_threat_intelligence_records":["5b6887bfa7772fa3692516af, 5b6887c09a6cf142fc3824f7"],"current_indicators":["123.123.123.123, swimlane.com"],"urlscan_most_recent_uuid":"e57c3c76-1902-40eb-be0f-24aa9f299e8b","urlscan_message":"Submission successful"}
Output
Parameter | Type | Description |
|---|---|---|
screenshot_attachment | array | Output field: screenshot_attachment |
screenshot_attachment.file_name | string | Name of the resource |
screenshot_attachment.file | string | Output field: screenshot_attachment.file |
most_recent_dom | string | Output field: most_recent_dom |
urlscan_result | string | URL endpoint for the request |
json | string | Output field: json |
requests | string | Output field: requests |
certificates | string | Output field: certificates |
domains_contacted | array | Output field: domains_contacted |
countries_contacted | array | Output field: countries_contacted |
ips_contacted | array | Output field: ips_contacted |
link_domains | array | Output field: link_domains |
servers_contacted | array | Output field: servers_contacted |
urls_requested | array | URL endpoint for the request |
most_recent_dom_fuzzy_hash | string | Output field: most_recent_dom_fuzzy_hash |
final_url | string | URL endpoint for the request |
potential_squatting_domain | string | Output field: potential_squatting_domain |
automated_verdict | string | Output field: automated_verdict |
landing_page_verdict | string | Output field: landing_page_verdict |
associated_ioc_verdict | string | Output field: associated_ioc_verdict |
analyst_verdict | string | Output field: analyst_verdict |
customer | string | Output field: customer |
search_term | string | Output field: search_term |
search_term_match_methods | array | HTTP method to use |
whois_information | string | Output field: whois_information |
Output Example
{"screenshot_attachment":[],"most_recent_dom":"Most Recent DOM","urlscan_result":"URLScan Result","json":"Most Recent URLScan JSON","requests":"Requests","certificates":"Certificates","domains_contacted":["Domains Contacted"],"countries_contacted":["Countries Contacted"],"ips_contacted":["IPs Contacted"],"link_domains":["Link Domains"],"servers_contacted":["Servers Contacted"],"urls_requested":["URLs Requested"],"most_recent_dom_fuzzy_hash":"Most Recent DOM Fuzzy Hash","final_url":"Final URL","p...
Deactivate All Potential Squatting Domains
Deactivate all potential squatting domains using ApplicationId, RecordId, potential squatting domain display name, and scan active field display name.
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
potential_squatting_domain_display_name | string | Required | Potential squatting domain field display name. |
scan_active_field_display_name | string | Required | Scan Active field display name. |
ApplicationId | string | Required | The ID of the application to deactivate all potential squatting domains of. |
RecordId | string | Required | The ID of the record to deactivate all potential squatting domains of. |
Input Example
{"potential_squatting_domain_display_name":"Potential Squatting Domain","scan_active_field_display_name":"Scan Active","ApplicationId":"aBLmK0zmAm8gfUY1A","RecordId":"aBLmK0zmAm8gfUY1A"}
Output
Parameter | Type | Description |
|---|---|---|
deactivated_records | array | Output field: deactivated_records |
completed | string | Output field: completed |
Output Example
{"deactivated_records":["Deactivated Records"],"completed":"Tue, 24 Oct 2023 06:28:56 GMT"}
Erase Current Snapshot Info
Erase the current snapshot information in Domain Squatting using RecordId and ApplicationId.
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
field_names | array | Optional | Field names to erase data from. |
RecordId | string | Required | The ID of the record to erase data from. |
ApplicationId | string | Required | The ID of the application to erase data from. |
Input Example
{"field_names":["Most Recent URLScan DOM, Most Recent URLScan Json, etc."],"RecordId":"aBLmK0zmAm8gfUY1A","ApplicationId":"aBLmK0zmAm8gfUY1A"}
Output
Parameter | Type | Description |
|---|---|---|
success | boolean | Whether the operation was successful |
errors | string | Error message if any |
completed | string | Output field: completed |
Output Example
{"success":true,"errors":"Errors","completed":"Tue, 24 Oct 2023 06:28:56 GMT"}
Find Potential Squatting Domains
Identify potential squatting domains by monitoring specified domain names. Requires monitored domain application name, domain to monitor display name, and search active display name.
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
monitored_domain_application_name | string | Required | Name of the application containing domains to monitor. |
domain_to_monitor_display_name | string | Required | Domain to monitor field display name. |
search_active_display_name | string | Required | Search active field display name. |
maximum_squatting_domains_display_name | string | Optional | Maximum potential squatting domains per day field display name. |
Input Example
{"monitored_domain_application_name":"Domain Squatting: Monitored Domain","domain_to_monitor_display_name":"Domain to Monitor","search_active_display_name":"Search Active","maximum_squatting_domains_display_name":"Maximum Potential Squatting Domains Per Day"}
Output
Parameter | Type | Description |
|---|---|---|
results | array | Result of the operation |
results.potential_squatting_domain | string | Result of the operation |
results.monitored_domain_record_id | string | Unique identifier |
results.matched_domain | string | Result of the operation |
results.search_term | string | Result of the operation |
results.search_term_match_methods | array | HTTP method to use |
Output Example
{"results":[]}
Refresh Active Potential Squatting Domains
Refresh data for active potential squatting domain records in Domain Squatting using specified application and field names.
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
potential_squatting_domain_app_name | string | Required | The potential squatting domain application name. |
scan_active_field_display_name | string | Required | The display name of the 'scan active' field. |
status_field_display_name | string | Required | The display name of the 'status' field. |
target_status_field_display_name | string | Required | The target value for the defined Status field. |
Input Example
{"potential_squatting_domain_app_name":"Domain Squatting: Potential Squatting Domain","scan_active_field_display_name":"Scan Active","status_field_display_name":"Status","target_status_field_display_name":"Preparing for Submission"}
Output
Parameter | Type | Description |
|---|---|---|
success | boolean | Whether the operation was successful |
errors | string | Error message if any |
completed | string | Output field: completed |
records_refreshed | array | Output field: records_refreshed |
Output Example
{"success":true,"errors":"Errors","completed":"Tue, 24 Oct 2023 06:28:56 GMT","records_refreshed":["Records Refreshed"]}
Retrieve Associated Record
Retrieve associated records in Domain Squatting using ApplicationId, RecordId, reference_record_id_display_name, and reference_field_display_name.
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
reference_record_id_display_name | string | Required | The display name of a list field containing record IDs. |
reference_field_display_name | string | Required | The display name of reference field that the record IDs will be mapped into. |
ApplicationId | string | Required | The ID of the application to retrieve the associated record from. |
RecordId | string | Required | The ID of the record to retrieve the associated record from. |
Input Example
{"reference_record_id_display_name":"Monitored Domain Record Id","reference_field_display_name":"Monitored Domains","ApplicationId":"aBLmK0zmAm8gfUY1A","RecordId":"aBLmK0zmAm8gfUY1A"}
Output
Parameter | Type | Description |
|---|---|---|
success | boolean | Whether the operation was successful |
errors | string | Error message if any |
completed | string | Output field: completed |
Output Example
{"success":true,"errors":"Errors","completed":"Tue, 24 Oct 2023 06:28:56 GMT"}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |