WHOIS Parse
Swimlane Parse WHOIS Connector
WHOIS Parse provides automated extraction and structuring of registration and ownership details from WHOIS records for domains and IP addresses.
WHOIS services provide essential information about domain and IP address registrations, including ownership, contact details, and availability status. The WHOIS Parse connector enables Swimlane Turbine users to automate the extraction and enrichment of registration data from domains, IP addresses, or raw WHOIS text. By integrating WHOIS data into security workflows, users can rapidly investigate suspicious domains or IPs, validate asset ownership, and enhance incident response with actionable contextβwithout writing code. This streamlines threat analysis, supports compliance efforts, and accelerates decision-making in security operations.
Prerequisites
The WHOIS Connector does not require an asset.
Capabilities
The Swimlane Parse WHOIS bundle has the following capabilities:
- Parse WHOIS text
- WHOIS Lookup
- WHOIS Lookup by IP
Actions
Parse WHOIS Text
Extract detailed registration information from provided WHOIS text for a specified domain.
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
domain | string | Required | Parameter for Parse WHOIS Text |
text | string | Required | Parameter for Parse WHOIS Text |
Input Example
{"domain":"string","text":"string"}
Output
Parameter | Type | Description |
|---|---|---|
headers | array | HTTP headers for the request |
headers.file_name | string | HTTP headers for the request |
headers.file | string | HTTP headers for the request |
reason | string | Response reason phrase |
status_code | number | HTTP status code of the response |
address | string | Output field: address |
whois_server | string | Output field: whois_server |
registrar | string | Output field: registrar |
raw_text | string | Output field: raw_text |
city | string | Output field: city |
raw_json | object | Output field: raw_json |
raw_json.domain_name | object | Name of the resource |
raw_json.registrar | object | Output field: raw_json.registrar |
raw_json.whois_server | object | Output field: raw_json.whois_server |
raw_json.referral_url | object | URL endpoint for the request |
raw_json.updated_date | object | Date value |
raw_json.creation_date | object | Date value |
raw_json.expiration_date | object | Date value |
raw_json.name_servers | object | Name of the resource |
raw_json.status | object | Status value |
raw_json.emails | object | Output field: raw_json.emails |
raw_json.dnssec | object | Output field: raw_json.dnssec |
raw_json.name | object | Name of the resource |
raw_json.org | object | Output field: raw_json.org |
raw_json.address | object | Output field: raw_json.address |
Output Example
{"headers":[],"reason":"OK","status_code":200,"address":null,"whois_server":null,"registrar":null,"raw_text":"google.com","city":null,"raw_json":{"domain_name":null,"registrar":null,"whois_server":null,"referral_url":null,"updated_date":null,"creation_date":null,"expiration_date":null,"name_servers":null,"status":null,"emails":null,"dnssec":null,"name":null,"org":null,"address":null,"city":null},"name_servers":null,"emails":null,"country":null,"zipcode":null,"name":null,"org":null}
WHOIS Lookup
Retrieve domain registration and availability details by performing a WHOIS lookup using the specified domain name.
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
domain | string | Required | Parameter for WHOIS Lookup |
raise | boolean | Optional | Raise an error if the WHOIS lookup fails |
Input Example
{"domain":"string","raise":true}
Output
Parameter | Type | Description |
|---|---|---|
headers | array | HTTP headers for the request |
reason | string | Response reason phrase |
status_code | number | HTTP status code of the response |
address | object | Output field: address |
whois_server | string | Output field: whois_server |
registrar | string | Output field: registrar |
raw_text | string | Output field: raw_text |
city | object | Output field: city |
raw_json | object | Output field: raw_json |
raw_json.domain_name | string | Name of the resource |
raw_json.registrar | string | Output field: raw_json.registrar |
raw_json.whois_server | string | Output field: raw_json.whois_server |
raw_json.referral_url | object | URL endpoint for the request |
raw_json.updated_date | string | Date value |
raw_json.creation_date | string | Date value |
raw_json.expiration_date | string | Date value |
raw_json.name_servers | array | Name of the resource |
raw_json.status | string | Status value |
raw_json.emails | array | Output field: raw_json.emails |
raw_json.dnssec | string | Output field: raw_json.dnssec |
raw_json.name | object | Name of the resource |
raw_json.org | string | Output field: raw_json.org |
raw_json.address | object | Output field: raw_json.address |
raw_json.city | object | Output field: raw_json.city |
raw_json.state | string | Output field: raw_json.state |
Output Example
{"headers":[],"reason":"OK","status_code":200,"address":null,"whois_server":"whois.markmonitor.com","registrar":"MarkMonitor, Inc.","raw_text":" Domain Name: GOOGLE.COM\r\n Registry Domain ID: 2138514_DOMAIN_COM-VRSN\r\n R...","city":null,"raw_json":{"domain_name":"google.com","registrar":"MarkMonitor, Inc.","whois_server":"whois.markmonitor.com","referral_url":null,"updated_date":"2019-09-09T15:39:04Z","creation_date":"1997-09-15T07:00:00Z","expiration_date":"2028-09-13T07:00:00Z","name_s...
WHOIS Lookup by IP
Perform a WHOIS lookup for a specified IPv4 or IPv6 address and return parsed registration and ownership details.
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
ip | string | Required | An IPv4 or IPv6 address. |
raise | boolean | Optional | Raise an error if the WHOIS lookup fails. |
Input Example
{"ip":"107.170.254.17"}
Output
Parameter | Type | Description |
|---|---|---|
headers | array | HTTP headers for the request |
headers.file_name | string | HTTP headers for the request |
headers.file | string | HTTP headers for the request |
reason | string | Response reason phrase |
status_code | number | HTTP status code of the response |
nir | object | Output field: nir |
asn_registry | string | Output field: asn_registry |
asn | string | Output field: asn |
asn_cidr | string | Unique identifier |
asn_country_code | string | Output field: asn_country_code |
asn_date | string | Date value |
asn_description | string | Output field: asn_description |
query | string | Output field: query |
network | object | Output field: network |
network.handle | string | Output field: network.handle |
network.status | array | Status value |
network.remarks | array | Output field: network.remarks |
network.remarks.title | string | Output field: network.remarks.title |
network.remarks.description | string | Output field: network.remarks.description |
network.remarks.links | object | Output field: network.remarks.links |
network.notices | array | Output field: network.notices |
network.notices.title | string | Output field: network.notices.title |
network.notices.description | string | Output field: network.notices.description |
network.notices.links | object | Output field: network.notices.links |
network.links | array | Output field: network.links |
Output Example
{"headers":[],"reason":"OK","status_code":200,"nir":null,"asn_registry":"arin","asn":"14061","asn_cidr":"107.170.192.0/18","asn_country_code":"US","asn_date":"2013-12-30","asn_description":"DIGITALOCEAN-ASN, US","query":"107.170.254.17","network":{"handle":"NET-107-170-0-0-1","status":["active"],"remarks":[{}],"notices":[{},{},{}],"links":["https://rdap.arin.net/registry/ip/107.170.0.0","https://whois.arin.net/rest/net/NET-107-170-0-0-1"],"events":[{},{}],"raw":null,"start_address":"107.170.0.0"...
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |