User Guide

Synapse-DomainIQ User Guide

Synapse-DomainIQ adds new Storm commands to allow you to query the DomainIQ API using your existing API key.

Getting Started

Check with your Admin to enable permissions and find out if you need a personal API key.

Examples

Setting your personal API key

To set-up a personal use API key:

> domainiq.setup.apikey --self myapikey
Setting DomainIQ API key for the current user.

Enrich an FQDN node with WHOIS data

Enrich some nodes with domainiq.whois and yield the results:

> [ inet:fqdn=google.com ] | domainiq.whois --yield
inet:whois:rec=('google.com', '2019/09/09 00:00:00.000')
        .created = 2024/03/28 14:40:06.289
        :asof = 2019/09/09 00:00:00.000
        :created = 1997/09/15 00:00:00.000
        :expires = 2028/09/14 00:00:00.000
        :fqdn = google.com
        :registrant =
        :registrar = markmonitor
        :text = domain name: google.com
                registry domain id: 2138514_domain_com-vrsn
                registrar whois server: whois.markmonitor.com
                registrar url: http://www.markmonitor.com
                updated date: 2019-09-09t15:39:04z
                creation date: 1997-09-15t04:00:00z
                registry expiry date: 2028-09-14t04:00:00z
                registrar: markmonitor inc.
                registrar iana id: 292
                registrar abuse contact email: [email protected]
                registrar abuse contact phone: +1.2083895740
                domain status: clientdeleteprohibited https://icann.org/epp#clientdeleteprohibited
                domain status: clienttransferprohibited https://icann.org/epp#clienttransferprohibited
                domain status: clientupdateprohibited https://icann.org/epp#clientupdateprohibited
                domain status: serverdeleteprohibited https://icann.org/epp#serverdeleteprohibited
                domain status: servertransferprohibited https://icann.org/epp#servertransferprohibited
                domain status: serverupdateprohibited https://icann.org/epp#serverupdateprohibited
                name server: ns1.google.com
                name server: ns2.google.com
                name server: ns3.google.com
                name server: ns4.google.com
                dnssec: unsigned
                url of the icann whois inaccuracy complaint form: https://www.icann.org/wicf/
                >>> last update of whois database: 2020-06-30t12:05:29z <<<
                domain name: google.com
                registry domain id: 2138514_domain_com-vrsn
                registrar whois server: whois.markmonitor.com
                registrar url: http://www.markmonitor.com
                updated date: 2019-09-09t08:39:04-0700
                creation date: 1997-09-15t00:00:00-0700
                registrar registration expiration date: 2028-09-13t00:00:00-0700
                registrar: markmonitor, inc.
                registrar iana id: 292
                registrar abuse contact email: [email protected]
                registrar abuse contact phone: +1.2083895770
                domain status: clientupdateprohibited (https://www.icann.org/epp#clientupdateprohibited)
                domain status: clienttransferprohibited (https://www.icann.org/epp#clienttransferprohibited)
                domain status: clientdeleteprohibited (https://www.icann.org/epp#clientdeleteprohibited)
                domain status: serverupdateprohibited (https://www.icann.org/epp#serverupdateprohibited)
                domain status: servertransferprohibited (https://www.icann.org/epp#servertransferprohibited)
                domain status: serverdeleteprohibited (https://www.icann.org/epp#serverdeleteprohibited)
                registrant organization: google llc
                registrant state/province: ca
                registrant country: us
                registrant email: select request email form at https://domains.markmonitor.com/whois/google.com
                admin organization: google llc
                admin state/province: ca
                admin country: us
                admin email: select request email form at https://domains.markmonitor.com/whois/google.com
                tech organization: google llc
                tech state/province: ca
                tech country: us
                tech email: select request email form at https://domains.markmonitor.com/whois/google.com
                name server: ns3.google.com
                name server: ns4.google.com
                name server: ns1.google.com
                name server: ns2.google.com
                dnssec: unsigned
                url of the icann whois data problem reporting system: http://wdprs.internic.net/
        :updated = 2019/09/09 00:00:00.000

Use of meta:source nodes

Synapse-DomainIQ uses a meta:source node and -(seen)> light weight edges to track nodes observed from the DomainIQ API.

> meta:source=6db396fb2a85daf8985b85f7921620b5
meta:source=6db396fb2a85daf8985b85f7921620b5
        .created = 2024/03/28 14:40:06.231
        :name = domainiq api

Storm can be used to filter nodes to include/exclude nodes which have been observed by Synapse-DomainIQ. The following example shows how to filter the results of a query to include only results observed by Synapse-DomainIQ:

> inet:whois:rec:fqdn=google.com +{ <(seen)- meta:source=6db396fb2a85daf8985b85f7921620b5 } -> inet:whois:recns
inet:whois:recns=('ns1.google.com', ('google.com', '2019/09/09 00:00:00.000'))
        .created = 2024/03/28 14:40:06.325
        :ns = ns1.google.com
        :rec = ('google.com', '2019/09/09 00:00:00.000')
        :rec:asof = 2019/09/09 00:00:00.000
        :rec:fqdn = google.com
inet:whois:recns=('ns2.google.com', ('google.com', '2019/09/09 00:00:00.000'))
        .created = 2024/03/28 14:40:06.336
        :ns = ns2.google.com
        :rec = ('google.com', '2019/09/09 00:00:00.000')
        :rec:asof = 2019/09/09 00:00:00.000
        :rec:fqdn = google.com