Guillaume BOURGEOIS
9589b4f0d1
8 commands: domain details, subdomains, WHOIS, DNS history, associated domains, IP neighbors, domain search. API-key auth, stdlib-only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
94 lines
3.4 KiB
YAML
94 lines
3.4 KiB
YAML
id: securitytrails
|
|
name: SecurityTrails
|
|
version: 1.0.0
|
|
description: "SecurityTrails (API v1) — DNS and domain intelligence: current domain details, subdomains, WHOIS, historical DNS, associated domains, IP neighbors and a domain filter search. API-key authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: domain details, subdomains, WHOIS, DNS history, associated domains, IP neighbors and domain search."
|
|
category: enrichment
|
|
|
|
config_schema:
|
|
properties:
|
|
api_key:
|
|
type: string
|
|
description: "SecurityTrails API key"
|
|
x-soar-sensitive: true
|
|
required:
|
|
- api_key
|
|
|
|
commands:
|
|
- id: domain_details
|
|
name: securitytrails-domain-details
|
|
description: "Current DNS and metadata for a domain (A/MX/NS/SOA/TXT records, host provider, Alexa rank)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
domain: { type: string, description: "Domain name" }
|
|
required: [domain]
|
|
outputs_schema: { properties: {} }
|
|
- id: subdomains
|
|
name: securitytrails-subdomains
|
|
description: "List the known subdomains of a domain."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
domain: { type: string, description: "Domain name" }
|
|
required: [domain]
|
|
outputs_schema: { properties: {} }
|
|
- id: domain_whois
|
|
name: securitytrails-domain-whois
|
|
description: "Current WHOIS record for a domain."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
domain: { type: string, description: "Domain name" }
|
|
required: [domain]
|
|
outputs_schema: { properties: {} }
|
|
- id: dns_history
|
|
name: securitytrails-dns-history
|
|
description: "Historical DNS records of a domain for a given record type."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
domain: { type: string, description: "Domain name" }
|
|
record_type: { type: string, description: "Record type: a, aaaa, mx, ns, soa or txt (default a)" }
|
|
required: [domain]
|
|
outputs_schema: { properties: {} }
|
|
- id: associated_domains
|
|
name: securitytrails-associated-domains
|
|
description: "Domains associated with the given domain (shared registrant/infrastructure)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
domain: { type: string, description: "Domain name" }
|
|
required: [domain]
|
|
outputs_schema: { properties: {} }
|
|
- id: ip_neighbors
|
|
name: securitytrails-ip-neighbors
|
|
description: "Neighboring IPs in the same range as the given IP, with hostname counts."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ip: { type: string, description: "IP address" }
|
|
required: [ip]
|
|
outputs_schema: { properties: {} }
|
|
- id: search_domain
|
|
name: securitytrails-search-domain
|
|
description: "Search domains with a filter (e.g. by keyword, mail provider, whois email)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
keyword: { type: string, description: "Substring the domain must contain" }
|
|
mail_provider: { type: string, description: "Mail provider filter" }
|
|
whois_email: { type: string, description: "WHOIS registrant email filter" }
|
|
limit: { type: number, description: "Maximum records (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: securitytrails-test-connection
|
|
description: "Verify the API key (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|