DNSDB_Co_Located_Hosts
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
author: Henry Stern, Farsight Security, Inc.
| Attribute | Value |
|---|---|
| Type | Playbook |
| Solution | Farsight DNSDB |
| Source | View on GitHub |
⚠️ Not listed in Solution JSON: This content item was discovered by scanning the solution folder but is not included in the official Solution JSON file. It may be a legacy item, under development, or excluded from the official solution package.
Logic App Connectors
This playbook uses 2 Logic App connectors / built-in actions:
| Connector / Action | Type | Connections | Actions |
|---|---|---|---|
azuresentinel |
Managed | 1 | 2 |
farsightdnsdb |
Managed | 1 | 4 |
Action parameters (URLs, paths, function IDs)
azuresentinel (Managed)
| Action | Method | Endpoint | Other |
|---|---|---|---|
| Entities_-_Get_Hosts | post | /entities/host |
— |
| Add_comment_to_incident_(V3) | post | /Incidents/Comment |
— |
farsightdnsdb (Managed)
| Action | Method | Endpoint | Other |
|---|---|---|---|
| RData_Lookup_with_RRType | get | /lookup/rdata/@{encodeURIComponent('ip')}/@{encodeURIComponent(items('For_each_Unique_IPS'))}/ANY |
— |
| RRSet_Lookup_with_RRType_AAAA_Records | get | /lookup/rrset/name/@{encodeURIComponent(variables('domain_name'))}/@{encodeURIComponent('AAAA')} |
— |
| RRSet_Lookup_with_RRType_A_Records | get | /lookup/rrset/name/@{encodeURIComponent(variables('domain_name'))}/@{encodeURIComponent('A')} |
— |
| RRSet_Lookup_with_RRType_CNAME | get | /lookup/rrset/name/@{encodeURIComponent(variables('domain_name'))}/@{encodeURIComponent('CNAME')} |
— |
Additional Documentation
📄 Source: DNSDB_Co_Located_Hosts/readme.md
author: Henry Stern, Farsight Security, Inc.
This playbook uses the Farsight DNSDB connector to automatically enrich Domain's found in the Sentinel incidents. This use case describes the desire to easily identify Hosts that are co-located (based on Address) based on the input of a Host and a given point in time. The response would be a set of domains that also shared the same IP address as the originating domain name at the given point in time. Learn more about the integration via the https://docs.microsoft.com/connectors/farsightdnsdb/ or visit https://www.farsightsecurity.com/about-farsight-security/contacts/ to request a trial key.
Screenshots
Links to deploy the DNSDB_Co_Located_Hosts playbook template:
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊