User Guide

Synapse-PSL User Guide

Synapse-PSL adds new Storm commands for ingesting the Public Suffix List.

Examples

List available configurations

Synapse-PSL does not require an API key, but uses a configuration to store the tag prefix, proxy, and SSL verification settings used when ingesting. A global configuration named default is created when the Power-Up is installed. To list the available configurations, use the psl.config.list command:

> psl.config.list
 name                      | scope    | owner
===========================|==========|====================================================
 default                   | global   | root

Set the tag prefix used to record ingested nodes

When ingesting the Public Suffix List, a tag will be applied to the inet:fqdn nodes with the value of the tag set to the time the command was run. The default tag prefix is rep.psl.suffix, which can be changed with the psl.config.update command:

> psl.config.update default --tag-prefix my.psl.suffix
Updated Synapse-PSL config "default"

Ingest the Public Suffix List

Note that normally this command should be allowed to run to completion, the example output is limited for demonstration purposes.

> psl.ingest --yield | limit 3
inet:fqdn=ac
        .created = 2026/10/22 20:04:01.141
        :host = ac
        :issuffix = true
        :iszone = false
        #rep.psl.suffix = (2026/10/22 20:04:01.135, 2026/10/22 20:04:01.136)
inet:fqdn=com.ac
        .created = 2026/10/22 20:04:01.144
        :domain = ac
        :host = com
        :issuffix = true
        :iszone = true
        :zone = com.ac
        #rep.psl.suffix = (2026/10/22 20:04:01.135, 2026/10/22 20:04:01.136)
inet:fqdn=edu.ac
        .created = 2026/10/22 20:04:01.146
        :domain = ac
        :host = edu
        :issuffix = true
        :iszone = true
        :zone = edu.ac
        #rep.psl.suffix = (2026/10/22 20:04:01.135, 2026/10/22 20:04:01.136)

Create a cron job to ingest the PSL daily

> cron.add --name psl.ingest --hour 5 { psl.ingest }
WARNING: "--hour" is deprecated and will be removed in v3.0.0.
Created cron job: 2a870fb8645a7b6cec7d818eb913d0c9

Use of meta:source nodes

Synapse-PSL uses a meta:source node and -(seen)> light weight edges to track nodes observed from the PSL API.

> meta:source=0cf6ba40daf9e36c7b7efb9d8e11ae50
meta:source=0cf6ba40daf9e36c7b7efb9d8e11ae50
        .created = 2026/10/22 20:04:01.134
        :name = public suffix list
        :type = synapse.psl

Storm can be used to filter nodes to include/exclude nodes which have been observed by Synapse-PSL. The following example shows how to filter the results of a query to include only results observed by Synapse-PSL:

> inet:fqdn=edu.ac +{ <(seen)- meta:source=0cf6ba40daf9e36c7b7efb9d8e11ae50 }
inet:fqdn=edu.ac
        .created = 2026/10/22 20:04:01.146
        :domain = ac
        :host = edu
        :issuffix = true
        :iszone = true
        :zone = edu.ac
        #rep.psl.suffix = (2026/10/22 20:04:01.135, 2026/10/22 20:04:01.136)