Public DNS Feed

Supported versions

Supported Cortex XSOAR versions: 5.5.0 and later.

A feed of known benign IPs of public DNS servers.

Configure Public DNS Feed on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.

  2. Search for Public DNS Feed.

  3. Click Add instance to create and configure a new integration instance.

    ParameterDescriptionRequired
    urlPublic DNS feed URLTrue
    feedFetch indicatorsFalse
    feedReputationIndicator ReputationFalse
    feedReliabilitySource ReliabilityTrue
    feedExpirationPolicyFalse
    feedFetchIntervalFeed Fetch IntervalFalse
    feedExpirationIntervalFalse
    feedTagsTagsFalse
    feedBypassExclusionListBypass exclusion listFalse
    tlp_colorTraffic Light Protocol ColorFalse
    insecureTrust any certificate (not secure)False
    proxyUse system proxy settingsFalse
  4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

public-dns-get-indicators


Gets indicators from the feed.

Base Command

public-dns-get-indicators

Input

Argument NameDescriptionRequired
limitThe maximum number of results to return. The default value is 10. Default is 10.Optional

Context Output

There is no context output for this command.

Command Example

!public-dns-get-indicators limit=2

Context Example

{
"Indicator": [
{
"rawJSON": {
"type": "IPv6",
"value": "2607:5300:203:1797::53"
},
"score": 0,
"type": "IPv6",
"value": "2607:5300:203:1797::53"
},
{
"rawJSON": {
"type": "Ip",
"value": "199.255.137.34"
},
"score": 0,
"type": "Ip",
"value": "199.255.137.34"
}
]
}

Human Readable Output

Public DNS Feed:

valuetype
2607:5300:203:1797::53IPv6
199.255.137.34Ip