Package Documentation
Storm Package: synapse-whoxy
The following Commands are available from this package. This documentation is generated for version 2.0.0 of the package.
Storm Commands
This package implements the following Storm Commands.
whoxy.config.add
Add a Synapse-Whoxy configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
When the proxy is set to a URL, the proxy-user and proxy-passwd arguments may
be used to authenticate to it. They must be URL safe; see $lib.inet.http.urlencode.
The password is stored in the configuration secrets, so it is only visible to
users with edit access to the configuration. Any stored credentials are removed
if the proxy is later set to true or false.
Examples:
// Add a global configuration
whoxy.config.add global_config apikey1234
// Add a configuration for the current user
whoxy.config.add --scope self my_config apikey5678
Usage: whoxy.config.add [options] <name> <apikey>
Options:
--help : Display the command usage.
--ssl-noverify : Do not perform SSL/TLS verification.
--proxy <proxy> : Configure the proxy usage. (default: True)
--proxy-user <proxy_user> : The username to authenticate to the proxy with.
--proxy-passwd <proxy_passwd>: The password to authenticate to the proxy with.
--scope <scope> : Set the scope on the configuration. A "self" config belongs to the user
who created it, and is stored and listed with the scope "user".
(default: global, choices: global, self, unscoped)
--no-check-apikey : Do not perform API key validation with Whoxy.
Arguments:
<name> : A unique name for the configuration.
<apikey> : The API key string.
The command is accessible to users with one or more of the following permissions:
power-ups.whoxy.adminpower-ups.whoxy.user
whoxy.config.del
Delete a Synapse-Whoxy configuration.
Examples:
// Delete the "fooconfig" configuration
whoxy.config.del fooconfig
Usage: whoxy.config.del [options] <name>
Options:
--help : Display the command usage.
Arguments:
<name> : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.whoxy.adminpower-ups.whoxy.user
whoxy.config.list
Display the list of Synapse-Whoxy configurations you have access to.
Usage: whoxy.config.list [options]
Options:
--help : Display the command usage.
The command is accessible to users with one or more of the following permissions:
power-ups.whoxy.adminpower-ups.whoxy.user
whoxy.config.migrate
Update options for every Synapse-Whoxy configuration at once.
Requires admin permission on the Synapse-Whoxy power-up.
API key validation is skipped when running this command.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
When the proxy is set to a URL, the proxy-user and proxy-passwd arguments may
be used to authenticate to it. They must be URL safe; see $lib.inet.http.urlencode.
The password is stored in the configuration secrets, so it is only visible to
users with edit access to the configuration. Any stored credentials are removed
if the proxy is later set to true or false.
Examples:
// Use a proxy for all configurations
whoxy.config.migrate --proxy https://proxy.example.com
Usage: whoxy.config.migrate [options]
Options:
--help : Display the command usage.
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--proxy-user <proxy_user> : The username to authenticate to the proxy with.
--proxy-passwd <proxy_passwd>: The password to authenticate to the proxy with.
The command is accessible to users with one or more of the following permissions:
power-ups.whoxy.admin
whoxy.config.show
Show the details of a configuration.
Examples:
// Show the in-use configuration for the current user
whoxy.config.show
// Show a configuration by name
whoxy.config.show myconfig
Usage: whoxy.config.show [options] <name>
Options:
--help : Display the command usage.
Arguments:
[name] : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.whoxy.adminpower-ups.whoxy.user
whoxy.config.update
Update the configuration of a defined Synapse-Whoxy configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
When the proxy is set to a URL, the proxy-user and proxy-passwd arguments may
be used to authenticate to it. They must be URL safe; see $lib.inet.http.urlencode.
The password is stored in the configuration secrets, so it is only visible to
users with edit access to the configuration. Any stored credentials are removed
if the proxy is later set to true or false.
Examples:
// Set the permission level for user "myuser" to "admin" on the "fooconfig"
// configuration
whoxy.config.update fooconfig --perm user myuser admin
// Set the permission level for the "all" role to "deny" on the
// "fooconfig" configuration
whoxy.config.update fooconfig --perm role all deny
// Do not verify the SSL certificate when connecting to "fooconfig"
whoxy.config.update fooconfig --ssl-verify (false)
// Change the name of the "fooconfig" configuration to "barconfig"
whoxy.config.update fooconfig --name barconfig
Usage: whoxy.config.update [options] <config>
Options:
--help : Display the command usage.
--apikey <apikey> : The API key string. (default: None)
--perm <perm> : Set the permission level for a user or role on this configuration.
Arguments to this option are `scope`, `name`, `level`:
<scope>: The scope for the permission, either "user" or "role".
<name>: The user/role name depending on scope.
<level>: The $lib.auth.easyperm.level name, or (null) to remove the
permission, which falls back to the config default.
(default: None)
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--proxy-user <proxy_user> : The username to authenticate to the proxy with.
--proxy-passwd <proxy_passwd>: The password to authenticate to the proxy with.
--name <name> : Rename the configuration. (default: None)
--no-check-apikey : Do not perform API key validation with Whoxy.
Arguments:
<config> : The name of the configuration to modify.
The command is accessible to users with one or more of the following permissions:
power-ups.whoxy.adminpower-ups.whoxy.user
whoxy.quota
Report the quota balances for the Whoxy API key.
Usage: whoxy.quota [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--config <config> : Override the default config with the provided name.
The command is accessible to users with one or more of the following permissions:
power-ups.whoxy.adminpower-ups.whoxy.user
whoxy.whois.history
Ingest Whoxy historical WHOIS records for an FQDN.
This command yields inet:whois:rec nodes,
and will also create inet:whois:contact and inet:whois:recns nodes.
Examples:
# Ingest historical records by inet:fqdn
inet:fqdn#foo | whoxy.whois.history
Usage: whoxy.whois.history [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--config <config> : Override the default config with the provided name.
--yield : Yield the newly created nodes.
--size <size> : Limit the number of results ingested to the given size (per-node).
--asof <asof> : This argument is deprecated and no longer has any effect.
The command is accessible to users with one or more of the following permissions:
power-ups.whoxy.adminpower-ups.whoxy.user
whoxy.whois.lookup
Retrieve a live WHOIS record for an FQDN.
This command yields an inet:whois:rec node,
and will also create inet:whois:contact and inet:whois:recns nodes.
Examples:
# Ingest the record by inet:fqdn
inet:fqdn#foo | whoxy.whois.lookup
Usage: whoxy.whois.lookup [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--config <config> : Override the default config with the provided name.
--yield : Yield the newly created nodes.
--size <size> : Limit the number of results ingested to the given size (per-node).
--asof <asof> : This argument is deprecated and no longer has any effect.
The command is accessible to users with one or more of the following permissions:
power-ups.whoxy.adminpower-ups.whoxy.user
whoxy.whois.reverse
Search Whoxy for WHOIS records by an identifier.
This command yields inet:whois:rec nodes,
and will also create inet:whois:contact and inet:whois:recns nodes.
The query argument can be used to search by a keyword
present at the start of the domain name.
NOTE - This command will also create an it:exec:query node to represent the
query syntax and link resulting nodes to it via -(found)> edges.
When an inbound node is provided it will also have a <(refs)- edge
to the it:exec:query node.
Examples:
# Search by domain owner name
ps:contact#foo :name -> ps:name | whoxy.whois.reverse
# Search by company / organization name
ou:org#foo :name -> ou:name | whoxy.whois.reverse
# Search by email address
inet:email#foo | whoxy.whois.reverse
# Search by domain name keyword
whoxy.whois.reverse --query yahoo
# Use node property to search by keyword
inet:fqdn#foo | whoxy.whois.reverse --query :host
Usage: whoxy.whois.reverse [options]
Options:
--help : Display the command usage.
--query <query> : Use the query string for a keyword search. (default: None)
--debug : Show verbose debug output.
--config <config> : Override the default config with the provided name.
--yield : Yield the newly created nodes.
--size <size> : Limit the number of results ingested to the given size (per-node).
--asof <asof> : This argument is deprecated and no longer has any effect.
The command is accessible to users with one or more of the following permissions:
power-ups.whoxy.adminpower-ups.whoxy.user
Storm Modules
This package does not export any Storm APIs.