--- title: Riskiq Passive Total slug: connectors/riskiq-passive-total docTags: createdAt: 2026-06-09T16:30:19.175Z --- RiskIQ PassiveTotal is a threat intelligence and digital risk management platform that uncovers threats and malicious actors across the internet. RiskIQ PassiveTotal offers comprehensive threat intelligence by analyzing diverse internet data. This connector enables Swimlane Turbine users to automate the retrieval of enrichment, WHOIS, and passive DNS data for domains and IP addresses. By integrating with RiskIQ PassiveTotal, security teams can enhance their incident response and threat hunting capabilities, leveraging rich context and historical data to make informed decisions. The connector simplifies complex investigations, allowing users to focus on mitigating threats and strengthening their security posture. ## Prerequisites To effectively utilize the RiskIQ PassiveTotal connector within Swimlane Turbine, ensure you have the following prerequisites: - HTTP Basic Authentication with the following parameters: - URL: The endpoint URL for the RiskIQ PassiveTotal API. - Username: Your RiskIQ account username. - API Secret: The API secret key associated with your RiskIQ account. ## Capabilities The RiskIQ Passivetotal connector has the following capabilities: - Passive DNS Lookup - Domain/IP Enrichment Data (list of subdomains, threat intel, more) - WHOIS Lookup ## Notes - [RiskIQ Passivetotal API Documentation](http://api.passivetotal.org/api/docs/) # Configurations ## HTTP Basic Authentication Authenticates using Username and API Secret. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | Username | string | Required | | password | API Secret, can be obtained from the RiskIQ settings menu. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get Enrichment Retrieve enrichment data for a specified query from RiskIQ Passive Total, requiring the 'query' parameter. ### Endpoint - **URL:** `/v2/enrichment` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ---------------------------------------- | | `parameters.query` | string | Required | Parameters for the Get Enrichment action | ### Input Example `{"parameters":{"query":"passivetotal.org"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | ----------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `classification` | string | Output field: classification | | `sinkhole` | boolean | Output field: sinkhole | | `everCompromised` | boolean | Output field: everCompromised | | `queryType` | string | Type of the resource | | `queryValue` | string | Value for the parameter | | `primaryDomain` | string | Output field: primaryDomain | | `tld` | string | Output field: tld | | `subdomains` | array | Output field: subdomains | | `tag_meta` | object | Output field: tag\_meta | | `tag_meta.mytag` | object | Output field: tag\_meta.mytag | | `tag_meta.mytag.creator` | string | Output field: tag\_meta.mytag.creator | | `tag_meta.mytag.created_at` | string | Output field: tag\_meta.mytag.created\_at | | `global_tags` | array | Output field: global\_tags | | `tags` | array | Output field: tags | | `system_tags` | array | Output field: system\_tags | | `dynamicDns` | boolean | Output field: dynamicDns | ### Output Example `{"status_code":200,"response_headers":{"Vary":"origin,access-control-request-method,access-control-request-headers,accept-encod...","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cache","Expires":"0","X-Frame-Options":"DENY","Content-Security-Policy":"script-src 'self' 'nonce-env' wcpstatic.microsoft.com","Content-Encoding":"gzip","Content-Type":"application/json","Transfer-Encoding":"chunked","D...` ## Get WHOIS Retrieve WHOIS data for a specified domain or IP address using RiskIQ Passive Total, providing detailed registration information. ### Endpoint - **URL:** `/v2/whois` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ----------------------------------- | | `parameters.query` | string | Optional | Parameters for the Get WHOIS action | | `parameters.compact_record` | boolean | Optional | Parameters for the Get WHOIS action | | `parameters.history` | boolean | Optional | Parameters for the Get WHOIS action | ### Input Example `{"parameters":{"query":"passivetotal.org","compact_record":false,"history":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | ------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `admin` | object | Output field: admin | | `admin.city` | string | Output field: admin.city | | `admin.country` | string | Output field: admin.country | | `admin.email` | string | Output field: admin.email | | `admin.name` | string | Name of the resource | | `admin.organization` | string | Output field: admin.organization | | `admin.postalCode` | string | Output field: admin.postalCode | | `admin.state` | string | Output field: admin.state | | `admin.street` | string | Output field: admin.street | | `billing` | object | Output field: billing | | `registrant` | object | Output field: registrant | | `registrant.city` | string | Output field: registrant.city | | `registrant.country` | string | Output field: registrant.country | | `registrant.email` | string | Output field: registrant.email | | `registrant.name` | string | Name of the resource | | `registrant.organization` | string | Output field: registrant.organization | | `registrant.postalCode` | string | Output field: registrant.postalCode | | `registrant.state` | string | Output field: registrant.state | | `registrant.street` | string | Output field: registrant.street | | `tech` | object | Output field: tech | | `tech.city` | string | Output field: tech.city | | `tech.country` | string | Output field: tech.country | | `tech.email` | string | Output field: tech.email | ### Output Example `{"status_code":200,"response_headers":{"Vary":"origin,access-control-request-method,access-control-request-headers,accept-encod...","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cache","Expires":"0","X-Frame-Options":"DENY","Content-Security-Policy":"script-src 'self' 'nonce-env'","Content-Encoding":"gzip","Content-Type":"application/json","Transfer-Encoding":"chunked","Date":"Mon, 03 Jul 2023 1...` ## Passive DNS Retrieve passive DNS data for a specified query from RiskIQ Passive Total, using active account sources. ### Endpoint - **URL:** `/v2/dns/passive` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------- | | `parameters.query` | string | Required | Parameters for the Passive DNS action | | `parameters.start` | string | Optional | Parameters for the Passive DNS action | | `parameters.end` | string | Optional | Parameters for the Passive DNS action | | `parameters.timeout` | number | Optional | Parameters for the Passive DNS action | ### Input Example `{"parameters":{"query":"passivetotal.org","start":"2015-01-01","end":"2015-01-02","timeout":7}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `pager` | object | Output field: pager | | `queryValue` | string | Value for the parameter | | `queryType` | string | Type of the resource | | `firstSeen` | string | Output field: firstSeen | | `lastSeen` | string | Output field: lastSeen | | `totalRecords` | number | Output field: totalRecords | | `results` | array | Result of the operation | | `results.firstSeen` | string | Result of the operation | | `results.lastSeen` | string | Result of the operation | | `results.source` | array | Result of the operation | | `results.value` | string | Value for the parameter | | `results.collected` | string | Result of the operation | | `results.recordType` | string | Type of the resource | | `results.resolve` | string | Result of the operation | | `results.resolveType` | string | Type of the resource | | `results.recordHash` | string | Result of the operation | ### Output Example `{"status_code":200,"response_headers":{"Vary":"origin,access-control-request-method,access-control-request-headers,accept-encod...","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cache","Expires":"0","X-Frame-Options":"DENY","Content-Security-Policy":"script-src 'self' 'nonce-env'","Content-Encoding":"gzip","Content-Type":"application/json","Transfer-Encoding":"chunked","Date":"Mon, 03 Jul 2023 1...` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | ---------------------------------------------------------- | ----------------------------------------------------------------------------------- | | Cache-Control | Directives for caching mechanisms | no-cache, no-store, max-age=0, must-revalidate | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | Content-Security-Policy | HTTP response header: Content-Security-Policy | script-src 'self' 'nonce-env' wcpstatic.microsoft.com | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Wed, 27 Nov 2024 10:20:59 GMT | | Expires | The date/time after which the response is considered stale | 0 | | Pragma | HTTP response header: Pragma | no-cache | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=63072000; includeSubDomains; preload; | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | Vary | HTTP response header: Vary | origin,access-control-request-method,access-control-request-headers,accept-encoding | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff | | X-Frame-Options | HTTP response header: X-Frame-Options | DENY | | X-XSS-Protection | HTTP response header: X-XSS-Protection | 1; mode=block |