Admin Guide

Synapse-Whoxy Admin Guide

Configuration

Synapse-Whoxy requires an API key. For information on how to signup, please visit the Whoxy API documentation.

Setting the configuration for global use

To set-up a global configuration:

> whoxy.config.add default myapikey
synapse-whoxy config "default" added

The API key is validated with Whoxy when a configuration is added or updated. Use --no-check-apikey to skip the validation.

Creating a configuration for role-based use

Add an unscoped configuration:

> whoxy.config.add myunscoped myapikey --scope unscoped
synapse-whoxy config "myunscoped" added

Grant another user admin permissions to the new configuration:

> whoxy.config.update myunscoped --perm user fred admin --no-check-apikey
Updated synapse-whoxy config "myunscoped"

Grant a role read permissions to the new configuration:

> whoxy.config.update myunscoped --perm role ninjas read --no-check-apikey
Updated synapse-whoxy config "myunscoped"

Overriding the proxy configuration

In order to override the default proxy configuration in the Cortex the user must have the power-ups.whoxy.admin or storm.lib.inet.http.proxy permission.

When the proxy configuration is set to (false) or a URL the permission will be checked when a configuration is created/updated, and when it is used to make an HTTP request.

Authenticating to the proxy

A configuration with a proxy URL may also provide credentials for the proxy:

> whoxy.config.update myunscoped --proxy http://proxy.vertex.link:3128 --proxy-user fred --proxy-passwd secret --no-check-apikey
Updated synapse-whoxy config "myunscoped"

The username is stored in the configuration and the password is stored in the configuration secrets. The credentials are only valid with a proxy URL, and are removed if the proxy is later set to (true) or (false). The values must be URL safe, see $lib.inet.http.urlencode.

Permissions

Package (synapse-whoxy) defines the following permissions:
power-ups.whoxy.user             : Allows a user to issue queries to the Whoxy API. ( default: false )
power-ups.whoxy.admin            : Controls access to Synapse-Whoxy admin options. ( default: false )

You may add rules to users/roles directly from storm:

> auth.user.addrule fred power-ups.whoxy.user
Added rule power-ups.whoxy.user to user fred.

or:

> auth.role.addrule ninjas power-ups.whoxy.user
Added rule power-ups.whoxy.user to role ninjas.

Exported APIs

Synapse-Whoxy does not currently export any APIs.

Node Actions

Synapse-Whoxy provides the following node actions in Optic:

Name : whoxy.whois.lookup
Desc : Ingest live WHOIS record.
Forms: inet:fqdn

Name : whoxy.whois.history
Desc : Ingest historical Whoxy WHOIS records.
Forms: inet:fqdn

Name : whoxy.whois.reverse
Desc : Search and ingest Whoxy WHOIS records.
Forms: ps:name, ou:name, inet:email

Onload Events

Synapse-Whoxy does not use any onload events. It uses Storm package inits to run required data migrations.

The node migrations run in every view. Views with a read-only write layer are skipped with a warning. Each migration runs once, and migrations already completed by earlier versions of the Power-Up are not run again.