Farsight DNSDB
Farsight DNSDB is a passive DNS database that enables detailed analysis of DNS records for security purposes.
Farsight DNSDB is a comprehensive DNS intelligence platform that provides real-time and historical DNS data. This connector allows Swimlane Turbine users to perform forward and inverse DNS lookups, retrieve summaries of DNS records, and monitor API rate limits. By integrating Farsight DNSDB with Swimlane Turbine, users can enhance their security automation workflows with enriched DNS data, enabling more effective threat detection and response.
DNSDB is a database that stores and indexes both the passive DNS data available via Farsight Securityβs Security Information Exchange as well as the authoritative DNS data that various zone operators make available.
Prerequisites
Before you can use the Farsight DNSDB connector for Turbine, you'll need access to the Farsight DNSDB API. This requires the following:
- an API key authentication using the following parameter:
- API Key: A unique key provided by Farsight DNSDB to authenticate API requests.
Capabilities
This Connector provides the following capabilities:
- Lookup RData
- Lookup RRset
- Rate Limit
- Summarize RData
- Summarize RRset
Notes
Additional Documentation
Configurations
DNSDB Asset
Authenticate using API Key
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
apikey | API Key for Authentication | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Lookup RData
Perform an inverse lookup in Farsight DNSDB's Rdata index using specified type, value, and ignore_limited parameters to query based on Rdata record values.
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
type | string | Required | Type of the resource |
value | string | Required | Value for the parameter |
ignore_limited | boolean | Required | Manually suppresses QueryLimited exceptions raised by the server if the query results exceed the row limited. |
rrtype | string | Optional | Type of the resource |
limit | number | Optional | Parameter for Lookup RData |
time_first_before | number | Optional | Parameter for Lookup RData |
time_last_before | number | Optional | Parameter for Lookup RData |
time_first_after | number | Optional | Parameter for Lookup RData |
time_last_after | number | Optional | Parameter for Lookup RData |
aggr | boolean | Optional | Parameter for Lookup RData |
offset | number | Optional | Parameter for Lookup RData |
Input Example
{"type":"ip","value":"8.8.8.8","ignore_limited":true,"rrtype":"A","limit":50,"time_first_before":1620000000,"time_last_before":1620000000,"time_first_after":1620000000,"time_last_after":1620000000,"aggr":true,"offset":100}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"reason":"OK","response_headers":{},"json_body":[{"count":5,"time_first":1706649024,"time_last":1710882816,"rrname":"identity.msbe.cie.ac.","rrtype":"A","rdata":["8.8.8.8"]},{"count":2,"time_first":1598818650,"time_last":1598818650,"rrname":"dmn.ac.","rrtype":"A","rdata":["8.8.8.8"]},{"count":38,"time_first":1620106630,"time_last":1620119528,"rrname":"lee.ac.","rrtype":"A","rdata":["8.8.8.8"]}]}
Lookup RRset
Perform a forward lookup in Farsight DNSDB's RRset index using the owner name of an RRset. Requires type and ignore_limited inputs.
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
owner_name | string | Optional | Name of the resource |
rrtype | string | Optional | Type of the resource |
ignore_limited | boolean | Required | Manually suppresses QueryLimited exceptions raised by the server if the query results exceed the row limited. |
bailiwick | string | Optional | Parameter for Lookup RRset |
limit | number | Optional | Parameter for Lookup RRset |
time_first_before | number | Optional | Parameter for Lookup RRset |
time_last_before | number | Optional | Parameter for Lookup RRset |
time_first_after | number | Optional | Parameter for Lookup RRset |
time_last_after | number | Optional | Parameter for Lookup RRset |
aggr | boolean | Optional | Parameter for Lookup RRset |
offset | number | Optional | Parameter for Lookup RRset |
Input Example
{"owner_name":"swimlane.com","rrtype":"A","ignore_limited":true,"bailiwick":"com","limit":50,"time_first_before":1620000000,"time_last_before":1620000000,"time_first_after":1620000000,"time_last_after":1620000000,"aggr":true,"offset":0}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"reason":"OK","response_headers":{},"json_body":[{"count":59,"time_first":1410402569,"time_last":1418156730,"rrname":"swimlane.com.","rrtype":"A","bailiwick":"swimlane.com.","rdata":["50.62.69.1"]},{"count":7362,"time_first":1425951270,"time_last":1456509794,"rrname":"swimlane.com.","rrtype":"A","bailiwick":"swimlane.com.","rdata":["50.116.22.188"]},{"count":1535,"time_first":1418257869,"time_last":1425945579,"rrname":"swimlane.com.","rrtype":"A","bailiwick":"swimlane.com.","r...
Rate Limit
Retrieve the current API rate limits for Farsight DNSDB to monitor usage and ensure compliance with access policies.
Output
Parameter | Type | Description |
|---|---|---|
rate | object | Output field: rate |
rate.limit | number | Output field: rate.limit |
rate.reset | number | Output field: rate.reset |
rate.offset_max | number | Output field: rate.offset_max |
rate.results_max | number | Result of the operation |
rate.remaining | number | Output field: rate.remaining |
Output Example
{"json_body":{"rate":{"limit":100,"reset":1710979200,"offset_max":3000000,"results_max":1000000,"remaining":94}}}
Summarize RData
Retrieve a summary of RData using the Farsight DNSDB API in JSON format. Requires type and value as inputs.
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
type | string | Required | Type of the resource |
value | string | Required | Value for the parameter |
rrtype | string | Optional | Type of the resource |
limit | number | Optional | Parameter for Summarize RData |
time_first_before | number | Optional | Parameter for Summarize RData |
time_last_before | number | Optional | Parameter for Summarize RData |
time_first_after | number | Optional | Parameter for Summarize RData |
time_last_after | number | Optional | Parameter for Summarize RData |
aggr | boolean | Optional | Parameter for Summarize RData |
max_count | number | Optional | Count value |
Input Example
{"type":"name","value":"swimlane.com","rrtype":"A","limit":50,"time_first_before":1620000000,"time_last_before":1620000000,"time_first_after":1620000000,"time_last_after":1620000000,"aggr":true,"max_count":1000}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"reason":"OK","response_headers":{},"json_body":[{"count":20,"num_results":1,"time_first":1411929062,"time_last":1417555530}]}
Summarize RRSet
Summarize resource record sets in Farsight DNSDB using the JSON format. Requires owner_name as input.
Endpoint
- URL: /dnsdb/v2/summarize/rrset
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
owner_name | string | Required | Name of the resource |
rrtype | string | Optional | Type of the resource |
bailiwick | string | Optional | Parameter for Summarize RRSet |
limit | number | Optional | Parameter for Summarize RRSet |
time_first_before | number | Optional | Parameter for Summarize RRSet |
time_last_before | number | Optional | Parameter for Summarize RRSet |
time_first_after | number | Optional | Parameter for Summarize RRSet |
time_last_after | number | Optional | Parameter for Summarize RRSet |
aggr | boolean | Optional | Parameter for Summarize RRSet |
max_count | number | Optional | Count value |
Input Example
{"owner_name":"swimlane.com","rrtype":"A","bailiwick":"com","limit":50,"time_first_before":1620000000,"time_last_before":1620000000,"time_first_after":1620000000,"time_last_after":1620000000,"aggr":true,"max_count":1000}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"reason":"OK","response_headers":{},"json_body":[{"count":741872,"num_results":306,"time_first":1283175634,"time_last":1710907196,"zone_time_first":1272125541,"zone_time_last":1710802220}]}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |