topic Re: XSOAR NSlookup and ThreatVault info in Cortex XSOAR Discussions

XSOAR NSlookup and ThreatVault info

Honza_Linhart — Fri, 02 Dec 2022 21:46:06 GMT

Hi everybody,

is there a way how to get following information in XSOAR?

- NSLOOKUP - I have an IP address and need to get name from internal DNS server

- Threat Vault info - I have an information from the firewall (threat name and threat ID) and I need to get more info like CVE number, threat description etc.

Thank you,

Jan

Re: XSOAR NSlookup and ThreatVault info

chrking — Mon, 05 Dec 2022 01:11:00 GMT

For nslookup, you can use the GetDomainDNSDetails automation.

For threat vault info you can use the threat vault integration: https://cortex.marketplace.pan.dev/marketplace/details/PaloAltoNetworks_Threat_Vault/ although if you have generic details (URL, IP, file hash etc) you could also query those through multiple sources through the standard url/ip/file commands.

Re: XSOAR NSlookup and ThreatVault info

Honza_Linhart — Mon, 05 Dec 2022 09:39:10 GMT

Hi Chrking,

thank you, I found both mentioned options, but there are few things not clear to me:

- Threat Vault integration is marked as Deprecated and doesn't contain things that I need to get like Threat description, CVE etc. I could get it using API calls described here https://pan.dev/cdss/docs/getstarted/ but there is no pre-built integration for it, am I right?

- GetDomainDNSDetails is able to return IP address when you have a domain name, but I'm not able to do reverse lookup - when I have an IP address and I need FQDN from internal DNS server.

Thank you,

Jan

Re: XSOAR NSlookup and ThreatVault info

chrking — Tue, 06 Dec 2022 00:27:06 GMT

As far as I know the only one for the threat vault is the one I listed. If you need extra info from your calls creating a copy and extending the existing integration is probably simpler than creating a new one from scratch.

Reverse DNS is just a standard forward DNS lookup with a special domain/type, so this still works.

Set the type to PTR and the domain to query to be the IP address in reverse order as a subdomain of in-addr.arpa

If you need to do this in a lot of different places perhaps it would make sense to handle it all inside an automation.

Re: XSOAR NSlookup and ThreatVault info

Honza_Linhart — Tue, 06 Dec 2022 07:43:52 GMT

That looks good. Thank you for your help and excuse my stupid questions, I'm a newbie to XSOAR and it isn't the easiest topic to grasp.

Jan