Riskiq Passive Total

RiskIQ PassiveTotal is a threat intelligence and digital risk management platform that uncovers threats and malicious actors across the internet.

RiskIQ PassiveTotal offers comprehensive threat intelligence by analyzing diverse internet data. This connector enables Swimlane Turbine users to automate the retrieval of enrichment, WHOIS, and passive DNS data for domains and IP addresses. By integrating with RiskIQ PassiveTotal, security teams can enhance their incident response and threat hunting capabilities, leveraging rich context and historical data to make informed decisions. The connector simplifies complex investigations, allowing users to focus on mitigating threats and strengthening their security posture.

Prerequisites

To effectively utilize the RiskIQ PassiveTotal connector within Swimlane Turbine, ensure you have the following prerequisites:

HTTP Basic Authentication with the following parameters:

URL: The endpoint URL for the RiskIQ PassiveTotal API.

Username: Your RiskIQ account username.

API Secret: The API secret key associated with your RiskIQ account.

Capabilities

The RiskIQ Passivetotal connector has the following capabilities:

Passive DNS Lookup

Domain/IP Enrichment Data (list of subdomains, threat intel, more)

WHOIS Lookup

Notes

RiskIQ Passivetotal API Documentation

Configurations

HTTP Basic Authentication

Authenticates using Username and API Secret.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	API Secret, can be obtained from the RiskIQ settings menu.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get Enrichment

Retrieve enrichment data for a specified query from RiskIQ Passive Total, requiring the 'query' parameter.

Endpoint

URL: /v2/enrichment

Method: GET

Input

Argument Name	Type	Required	Description
parameters.query	string	Required	Parameters for the Get Enrichment action

Input Example

{"parameters":{"query":"passivetotal.org"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
classification	string	Output field: classification
sinkhole	boolean	Output field: sinkhole
everCompromised	boolean	Output field: everCompromised
queryType	string	Type of the resource
queryValue	string	Value for the parameter
primaryDomain	string	Output field: primaryDomain
tld	string	Output field: tld
subdomains	array	Output field: subdomains
tag_meta	object	Output field: tag_meta
tag_meta.mytag	object	Output field: tag_meta.mytag
tag_meta.mytag.creator	string	Output field: tag_meta.mytag.creator
tag_meta.mytag.created_at	string	Output field: tag_meta.mytag.created_at
global_tags	array	Output field: global_tags
tags	array	Output field: tags
system_tags	array	Output field: system_tags
dynamicDns	boolean	Output field: dynamicDns

Output Example

{"status_code":200,"response_headers":{"Vary":"origin,access-control-request-method,access-control-request-headers,accept-encod...","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cache","Expires":"0","X-Frame-Options":"DENY","Content-Security-Policy":"script-src 'self' 'nonce-env' wcpstatic.microsoft.com","Content-Encoding":"gzip","Content-Type":"application/json","Transfer-Encoding":"chunked","D...

Get WHOIS

Retrieve WHOIS data for a specified domain or IP address using RiskIQ Passive Total, providing detailed registration information.

Endpoint

URL: /v2/whois

Method: GET

Input

Argument Name	Type	Required	Description
parameters.query	string	Optional	Parameters for the Get WHOIS action
parameters.compact_record	boolean	Optional	Parameters for the Get WHOIS action
parameters.history	boolean	Optional	Parameters for the Get WHOIS action

Input Example

{"parameters":{"query":"passivetotal.org","compact_record":false,"history":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
admin	object	Output field: admin
admin.city	string	Output field: admin.city
admin.country	string	Output field: admin.country
admin.email	string	Output field: admin.email
admin.name	string	Name of the resource
admin.organization	string	Output field: admin.organization
admin.postalCode	string	Output field: admin.postalCode
admin.state	string	Output field: admin.state
admin.street	string	Output field: admin.street
billing	object	Output field: billing
registrant	object	Output field: registrant
registrant.city	string	Output field: registrant.city
registrant.country	string	Output field: registrant.country
registrant.email	string	Output field: registrant.email
registrant.name	string	Name of the resource
registrant.organization	string	Output field: registrant.organization
registrant.postalCode	string	Output field: registrant.postalCode
registrant.state	string	Output field: registrant.state
registrant.street	string	Output field: registrant.street
tech	object	Output field: tech
tech.city	string	Output field: tech.city
tech.country	string	Output field: tech.country
tech.email	string	Output field: tech.email

Output Example

{"status_code":200,"response_headers":{"Vary":"origin,access-control-request-method,access-control-request-headers,accept-encod...","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cache","Expires":"0","X-Frame-Options":"DENY","Content-Security-Policy":"script-src 'self' 'nonce-env'","Content-Encoding":"gzip","Content-Type":"application/json","Transfer-Encoding":"chunked","Date":"Mon, 03 Jul 2023 1...

Passive DNS

Retrieve passive DNS data for a specified query from RiskIQ Passive Total, using active account sources.

Endpoint

URL: /v2/dns/passive

Method: GET

Input

Argument Name	Type	Required	Description
parameters.query	string	Required	Parameters for the Passive DNS action
parameters.start	string	Optional	Parameters for the Passive DNS action
parameters.end	string	Optional	Parameters for the Passive DNS action
parameters.timeout	number	Optional	Parameters for the Passive DNS action

Input Example

{"parameters":{"query":"passivetotal.org","start":"2015-01-01","end":"2015-01-02","timeout":7}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
pager	object	Output field: pager
queryValue	string	Value for the parameter
queryType	string	Type of the resource
firstSeen	string	Output field: firstSeen
lastSeen	string	Output field: lastSeen
totalRecords	number	Output field: totalRecords
results	array	Result of the operation
results.firstSeen	string	Result of the operation
results.lastSeen	string	Result of the operation
results.source	array	Result of the operation
results.value	string	Value for the parameter
results.collected	string	Result of the operation
results.recordType	string	Type of the resource
results.resolve	string	Result of the operation
results.resolveType	string	Type of the resource
results.recordHash	string	Result of the operation

Output Example

{"status_code":200,"response_headers":{"Vary":"origin,access-control-request-method,access-control-request-headers,accept-encod...","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cache","Expires":"0","X-Frame-Options":"DENY","Content-Security-Policy":"script-src 'self' 'nonce-env'","Content-Encoding":"gzip","Content-Type":"application/json","Transfer-Encoding":"chunked","Date":"Mon, 03 Jul 2023 1...

Response Headers

Header	Description	Example
Cache-Control	Directives for caching mechanisms	no-cache, no-store, max-age=0, must-revalidate
Content-Encoding	HTTP response header: Content-Encoding	gzip
Content-Security-Policy	HTTP response header: Content-Security-Policy	script-src 'self' 'nonce-env' wcpstatic.microsoft.com
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Wed, 27 Nov 2024 10:20:59 GMT
Expires	The date/time after which the response is considered stale	0
Pragma	HTTP response header: Pragma	no-cache
Strict-Transport-Security	HTTP response header: Strict-Transport-Security	max-age=63072000; includeSubDomains; preload;
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
Vary	HTTP response header: Vary	origin,access-control-request-method,access-control-request-headers,accept-encoding
X-Content-Type-Options	HTTP response header: X-Content-Type-Options	nosniff
X-Frame-Options	HTTP response header: X-Frame-Options	DENY
X-XSS-Protection	HTTP response header: X-XSS-Protection	1; mode=block