id: securitytrails
name: SecurityTrails
version: 1.0.0
description: "SecurityTrails (API v1) — DNS and domain intelligence: current domain details, subdomains, WHOIS, historical DNS, associated domains, IP neighbors and a domain filter search. API-key authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: domain details, subdomains, WHOIS, DNS history, associated domains, IP neighbors and domain search."
category: enrichment

config_schema:
  properties:
    api_key:
      type: string
      description: "SecurityTrails API key"
      x-soar-sensitive: true
  required:
    - api_key

commands:
  - id: domain_details
    name: securitytrails-domain-details
    description: "Current DNS and metadata for a domain (A/MX/NS/SOA/TXT records, host provider, Alexa rank)."
    risk: read
    inputs_schema:
      properties:
        domain: { type: string, description: "Domain name" }
      required: [domain]
    outputs_schema: { properties: {} }
  - id: subdomains
    name: securitytrails-subdomains
    description: "List the known subdomains of a domain."
    risk: read
    inputs_schema:
      properties:
        domain: { type: string, description: "Domain name" }
      required: [domain]
    outputs_schema: { properties: {} }
  - id: domain_whois
    name: securitytrails-domain-whois
    description: "Current WHOIS record for a domain."
    risk: read
    inputs_schema:
      properties:
        domain: { type: string, description: "Domain name" }
      required: [domain]
    outputs_schema: { properties: {} }
  - id: dns_history
    name: securitytrails-dns-history
    description: "Historical DNS records of a domain for a given record type."
    risk: read
    inputs_schema:
      properties:
        domain: { type: string, description: "Domain name" }
        record_type: { type: string, description: "Record type: a, aaaa, mx, ns, soa or txt (default a)" }
      required: [domain]
    outputs_schema: { properties: {} }
  - id: associated_domains
    name: securitytrails-associated-domains
    description: "Domains associated with the given domain (shared registrant/infrastructure)."
    risk: read
    inputs_schema:
      properties:
        domain: { type: string, description: "Domain name" }
      required: [domain]
    outputs_schema: { properties: {} }
  - id: ip_neighbors
    name: securitytrails-ip-neighbors
    description: "Neighboring IPs in the same range as the given IP, with hostname counts."
    risk: read
    inputs_schema:
      properties:
        ip: { type: string, description: "IP address" }
      required: [ip]
    outputs_schema: { properties: {} }
  - id: search_domain
    name: securitytrails-search-domain
    description: "Search domains with a filter (e.g. by keyword, mail provider, whois email)."
    risk: read
    inputs_schema:
      properties:
        keyword: { type: string, description: "Substring the domain must contain" }
        mail_provider: { type: string, description: "Mail provider filter" }
        whois_email: { type: string, description: "WHOIS registrant email filter" }
        limit: { type: number, description: "Maximum records (default 100)" }
      required: []
    outputs_schema: { properties: {} }

  - id: test_connection
    name: securitytrails-test-connection
    description: "Verify the API key (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }