DNSDB_Historical_Address

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

author: Henry Stern, Farsight Security, Inc.

Attribute	Value
Type	Playbook
Solution	Farsight DNSDB
Source	View on GitHub

⚠️ Not listed in Solution JSON: This content item was discovered by scanning the solution folder but is not included in the official Solution JSON file. It may be a legacy item, under development, or excluded from the official solution package.

Logic App Connectors

This playbook uses 2 Logic App connectors / built-in actions:

Connector / Action	Type	Connections	Actions
`azuresentinel`	Managed	1	2
`farsightdnsdb`	Managed	1	2

Action parameters (URLs, paths, function IDs)

`azuresentinel` (Managed)

Action	Method	Endpoint	Other
Entities_-_Get_Hosts	post	`/entities/host`	—
Add_comment_to_incident_(V3)	post	`/Incidents/Comment`	—

`farsightdnsdb` (Managed)

Action	Method	Endpoint	Other
RRSet_Lookup_with_RRType_AAAA_Records	get	`/lookup/rrset/name/@{encodeURIComponent(variables('domain_name'))}/@{encodeURIComponent('AAAA')}`	—
RRSet_Lookup_with_RRType_A_Records	get	`/lookup/rrset/name/@{encodeURIComponent(variables('domain_name'))}/@{encodeURIComponent('A')}`	—

Additional Documentation

📄 Source: DNSDB_Historical_Address/readme.md

author: Henry Stern, Farsight Security, Inc.

This playbook uses the Farsight DNSDB connector to automatically enrich Domain's found in the Sentinel incidents. This use case describes the desire to identify all Addresses used as DNS A records for a given Host based on a time window from a starting and stopping point in time. Learn more about the integration via the https://docs.microsoft.com/connectors/farsightdnsdb/ or visit https://www.farsightsecurity.com/about-farsight-security/contacts/ to request a trial key.

Screenshots

Incident Comments

Links to deploy the DNSDB_Historical_Address playbook template: