RiskIQ Digital Footprint

RiskIQ Digital Footprint integration enables your security team to manage assets outside your firewall, by bringing its details, providing you to add or update assets and analyze your digital footprint from the view of the global adversary with the help of various commands that summarise the activities performed on your assets. This integration was integrated and tested with enterprise version of RiskIQDigitalFootprint.

Configure RiskIQDigitalFootprint on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for RiskIQDigitalFootprint.
  3. Click Add instance to create and configure a new integration instance.
ParameterDescriptionRequired
urlAPI URLTrue
tokenAPI TokenTrue
secretAPI SecretTrue
insecureTrust any certificate (not secure)False
proxyUse system proxy settingsFalse
  1. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Demisto CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

df-asset-connections


Retrieve the set of assets that are connected to the requested asset.

Base Command

df-asset-connections

Input

Argument NameDescriptionRequired
typeThe type of the asset for which connections are to be fetched.Valid Types: Domain, Host, IP Address, IP Block, ASN, Page, SSL Cert, Contact. This argument supports a single value only.Required
nameThe name of the asset for which connections are to be fetched. For example riskiq.com, 8.8.8.8, mail.net, etc. This argument supports a single value only.Required
globalSetting this value to true will search all of the global inventory. Setting it to false will search for assets in the workspace associated with the authentication token. The default value for this argument from RiskIQ platform is false. This argument supports a single value only.Optional
pageThe index of the page to retrieve. The index is zero based so the first page is page 0. The default value for this argument from RiskIQ platform is 0.Optional
sizeThe response contains a page of assets for each related asset type. Size determines the number of associated assets of each type that are returned. The default value for this argument from RiskIQ platform is 20. If a large value is entered for this argument, it might take a while to fetch the response.Optional

Context Output

PathTypeDescription
Domain.NameStringThe domain name.
Domain.OrganizationStringThe organization of the domain.
IP.AddressStringIP address.
URL.DataStringThe URL.
DBotScore.IndicatorStringThe indicator that was tested.
DBotScore.TypeStringThe indicator type.
DBotScore.VendorStringThe vendor used to calculate the score.
DBotScore.ScoreNumberThe actual score.
RiskIQDigitalFootprint.Asset.nameStringName of the connected asset.
RiskIQDigitalFootprint.Asset.typeStringType of the connected asset.
RiskIQDigitalFootprint.Asset.stateStringState of the connected asset.
RiskIQDigitalFootprint.Asset.firstSeenDateDate and Time when the connected asset was first observed.
RiskIQDigitalFootprint.Asset.lastSeenDateDate and Time when the connected asset was most recently observed.
RiskIQDigitalFootprint.Asset.uuidStringUUID of the connected asset.
RiskIQDigitalFootprint.Asset.labelStringLabel of the connected asset.
RiskIQDigitalFootprint.Asset.descriptionStringDescription of the connected asset.
RiskIQDigitalFootprint.Asset.confidenceStringDiscovery confidence level of the connected asset.
RiskIQDigitalFootprint.Asset.priorityStringPriority of the connected asset.
RiskIQDigitalFootprint.Asset.autoConfirmedBooleanWas the connected asset auto-confirmed.
RiskIQDigitalFootprint.Asset.enterpriseBooleanHas the connected asset been designated as an enterprise asset.
RiskIQDigitalFootprint.Asset.keystoneBooleanWas the connected asset designated as a discovery keystone.
RiskIQDigitalFootprint.Asset.organizations.createdAtDateDate and Time when the organization applied to the asset was created.
RiskIQDigitalFootprint.Asset.organizations.updatedAtDateDate and Time when the organization applied to the asset was updated.
RiskIQDigitalFootprint.Asset.organizations.statusStringStatus of the organization applied to the asset.
RiskIQDigitalFootprint.Asset.organizations.workspaceOrganizationIDNumberID of the organization applied to the asset in the user's workspace.
RiskIQDigitalFootprint.Asset.organizations.workspaceIDNumberID of the user's workspace.
RiskIQDigitalFootprint.Asset.organizations.nameStringName of the organization applied to the asset.
RiskIQDigitalFootprint.Asset.organizations.idNumberID of the organization applied to the asset.
RiskIQDigitalFootprint.Asset.tags.createdAtDateDate and Time when the tag applied to the asset was created.
RiskIQDigitalFootprint.Asset.tags.updatedAtDateDate and Time when the tag applied to the asset was updated.
RiskIQDigitalFootprint.Asset.tags.statusStringStatus of the tag applied to the asset.
RiskIQDigitalFootprint.Asset.tags.workspaceTagIDNumberID of the tag applied to the asset in the user's workspace.
RiskIQDigitalFootprint.Asset.tags.workspaceIDNumberID of the user's workspace.
RiskIQDigitalFootprint.Asset.tags.workspaceTagTypeStringWorkspace type of the tag applied to the asset.
RiskIQDigitalFootprint.Asset.tags.colorStringColor of the tag applied to the asset.
RiskIQDigitalFootprint.Asset.tags.nameStringName of the tag applied to the asset.
RiskIQDigitalFootprint.Asset.tags.idNumberID of the tag applied to the asset.
RiskIQDigitalFootprint.Asset.brands.createdAtDateDate and Time when the brand applied to the asset was created.
RiskIQDigitalFootprint.Asset.brands.updatedAtDateDate and Time when the brand applied to the asset was updated.
RiskIQDigitalFootprint.Asset.brands.statusStringStatus of the brand applied to the asset.
RiskIQDigitalFootprint.Asset.brands.workspaceBrandIDNumberID of the brand applied to the asset in the user's workspace.
RiskIQDigitalFootprint.Asset.brands.workspaceIDNumberID of the user's workspace.
RiskIQDigitalFootprint.Asset.brands.nameStringName of the brand applied to the asset.
RiskIQDigitalFootprint.Asset.brands.idNumberID of the brand applied to the asset.
RiskIQDigitalFootprint.Asset.createdAtDateThe date that the connected asset was added to inventory.
RiskIQDigitalFootprint.Asset.updatedAtDateThe date of the most recent update performed by a user action for the connected asset.
RiskIQDigitalFootprint.Asset.hostExcludedBooleanIf true then only IP Addresses associated with confirmed IP Blocks will be included in the results. Possible Values: True, False.
RiskIQDigitalFootprint.Asset.idNumberID of the connected asset.
RiskIQDigitalFootprint.Asset.sourceStringIf the source of the connected asset is known.

Command Example

!df-asset-connections type="Domain" name="dummy.com" size="2"

Context Example

{
"DBotScore": [
{
"Indicator": "https://dummyurl.com",
"Score": 0,
"Type": "url",
"Vendor": "RiskIQ Digital Footprint"
},
{
"Indicator": "http://dummyurl.com",
"Score": 0,
"Type": "url",
"Vendor": "RiskIQ Digital Footprint"
}
],
"RiskIQDigitalFootprint": {
"Asset": [
{
"autoConfirmed": true,
"confidence": "ABSOLUTE",
"createdAt": 1594469523567,
"description": "host.dummy.com",
"enterprise": false,
"firstSeen": 1594168047000,
"id": 230123528,
"keystone": false,
"label": "host.dummy.com",
"lastSeen": 1594508906149,
"name": "host.dummy.com",
"priority": "NONE",
"state": "CONFIRMED",
"type": "HOST",
"updatedAt": 1594470594948,
"uuid": "2d9400ec-4572-2b68-2638-9c57364eca91",
"wildcard": true
},
{
"autoConfirmed": true,
"confidence": "ABSOLUTE",
"createdAt": 1594468714807,
"description": "host1.dummy.com",
"enterprise": false,
"firstSeen": 1593899022000,
"id": 230123266,
"keystone": false,
"label": "host1.dummy.com",
"lastSeen": 1594508906149,
"name": "host1.dummy.com",
"priority": "NONE",
"state": "CONFIRMED",
"type": "HOST",
"updatedAt": 1594470594948,
"uuid": "454cb72a-a1a6-3081-fdfa-d399d4dc823d",
"wildcard": true
},
{
"autoConfirmed": false,
"createdAt": 1594456489831,
"description": "https://dummyurl.com",
"enterprise": false,
"firstSeen": 1594301578052,
"keystone": false,
"label": "https://dummyurl.com",
"lastSeen": 1594301578052,
"name": "https://dummyurl.com",
"state": "CONFIRMED",
"type": "PAGE",
"updatedAt": 1594456489831,
"uuid": "1ad9db5a-dca3-e0ba-9d13-4d2e0c364b37",
"wildcard": false
},
{
"autoConfirmed": false,
"createdAt": 1594456489831,
"description": "http://dummyurl.com",
"enterprise": false,
"firstSeen": 1594301577733,
"keystone": false,
"label": "http://dummyurl.com",
"lastSeen": 1594301577733,
"name": "http://dummyurl.com",
"state": "CONFIRMED",
"type": "PAGE",
"updatedAt": 1594456489831,
"uuid": "771cb53a-8c62-aaa3-33bc-c6aceedb0d7a",
"wildcard": false
}
]
},
"URL": [
{
"Data": "https://dummyurl.com"
},
{
"Data": "http://dummyurl.com"
}
]
}

Human Readable Output

CONNECTED ASSETS

Total Hosts: 20

Fetched Hosts: 2

NameStateFirst Seen (GMT)Last Seen (GMT)
host.dummy.comCONFIRMED2020-07-08 00:27:272020-07-11 23:08:26
host1.dummy.comCONFIRMED2020-07-04 21:43:422020-07-11 23:08:26

Total Pages: 50

Fetched Pages: 2

NameStateFirst Seen (GMT)Last Seen (GMT)
https://dummyurl.comCONFIRMED2020-07-09 13:32:582020-07-09 13:32:58
http://dummyurl.comCONFIRMED2020-07-09 13:32:572020-07-09 13:32:57

df-asset-changes-summary


Retrieve summary information describing counts of confirmed assets that have been added, removed or changed in inventory over the given time period.

Base Command

df-asset-changes-summary

Input

Argument NameDescriptionRequired
dateThe date of the run in which the changes were identified (YYYY-MM-DD). If not passed it would consider the most recently run date when the discovery was run on RiskIQ Digital Footprint. This argument supports a single value only.Optional
rangeThe period of time for which the changes summary is to be fetched. Supported ranges are 1, 7, and 30 days. The default value for this argument from RiskIQ platform is 1. This argument supports a single value only.Optional
brandFilter summary of changed assets based on the brand associated with the assets. This argument supports a single value only.Optional
organizationFilter summary of changed assets based on the organization associated with the assets. This argument supports a single value only.Optional
tagFilter summary of changed assets based on the tag associated with the assets. This argument supports a single value only.Optional

Context Output

PathTypeDescription
RiskIQDigitalFootprint.AssetSummary.runDateStringThe date of the run in which the changes were identified.
RiskIQDigitalFootprint.AssetSummary.deltas.typeStringType of the asset.
RiskIQDigitalFootprint.AssetSummary.deltas.aggregations.removedNumberCount of removed assets from Global Inventory in range of 1, 7, and 30 days from the most recently run date.
RiskIQDigitalFootprint.AssetSummary.deltas.aggregations.addedNumberCount of added assets to Global Inventory in range of 1, 7, and 30 days from the most recently run date.
RiskIQDigitalFootprint.AssetSummary.deltas.aggregations.changedNumberCount of changed assets from Global Inventory in range of 1, 7, and 30 days from the most recently run date.
RiskIQDigitalFootprint.AssetSummary.deltas.aggregations.countNumberIt indicates the number of confirmed assets in inventory
RiskIQDigitalFootprint.AssetSummary.deltas.aggregations.rangeNumberThe period of time over which the changes were identified. Supported ranges are 1, 7, and 30 days.
RiskIQDigitalFootprint.AssetSummary.deltas.aggregations.differenceNumberIt indicates the result of added minus removed assets.

Command Example

!df-asset-changes-summary

Context Example

{
"RiskIQDigitalFootprint": {
"AssetSummary": {
"deltas": [
{
"aggregations": [
{
"added": 0,
"count": 25,
"difference": 0,
"range": 1,
"removed": 0
},
{
"added": 0,
"count": 0,
"difference": -2,
"range": 7,
"removed": 2
},
{
"added": 5,
"count": 0,
"difference": 2,
"range": 30,
"removed": 3
}
],
"type": "DOMAIN"
},
{
"aggregations": [
{
"added": 26,
"count": 21134,
"difference": 26,
"range": 1,
"removed": 0
},
{
"added": 27,
"count": 0,
"difference": 27,
"range": 7,
"removed": 0
},
{
"added": 175,
"count": 0,
"difference": 175,
"range": 30,
"removed": 0
}
],
"type": "HOST"
},
{
"aggregations": [
{
"added": 54,
"count": 321107,
"difference": 54,
"range": 1,
"removed": 0
},
{
"added": 3477,
"count": 0,
"difference": 3469,
"range": 7,
"removed": 8
},
{
"added": 17232,
"count": 0,
"difference": 17089,
"range": 30,
"removed": 143
}
],
"type": "PAGE"
},
{
"aggregations": [
{
"added": 14,
"count": 305,
"difference": 14,
"range": 1,
"removed": 0
},
{
"added": 14,
"count": 0,
"difference": 13,
"range": 7,
"removed": 1
},
{
"added": 20,
"count": 0,
"difference": 14,
"range": 30,
"removed": 6
}
],
"type": "SSL_CERT"
},
{
"aggregations": [
{
"added": 0,
"count": 6,
"difference": 0,
"range": 1,
"removed": 0
},
{
"added": 0,
"count": 0,
"difference": 0,
"range": 7,
"removed": 0
},
{
"added": 6,
"count": 0,
"difference": 6,
"range": 30,
"removed": 0
}
],
"type": "AS"
},
{
"aggregations": [
{
"added": 0,
"count": 3,
"difference": 0,
"range": 1,
"removed": 0
},
{
"added": 0,
"count": 0,
"difference": 0,
"range": 7,
"removed": 0
},
{
"added": 1,
"count": 0,
"difference": 1,
"range": 30,
"removed": 0
}
],
"type": "IP_BLOCK"
},
{
"aggregations": [
{
"added": 87,
"count": 1744,
"difference": 87,
"range": 1,
"removed": 0
},
{
"added": 87,
"count": 0,
"difference": 87,
"range": 7,
"removed": 0
},
{
"added": 92,
"count": 0,
"difference": 92,
"range": 30,
"removed": 0
}
],
"type": "IP_ADDRESS"
},
{
"aggregations": [
{
"added": 0,
"count": 4,
"difference": 0,
"range": 1,
"removed": 0
},
{
"added": 0,
"count": 0,
"difference": 0,
"range": 7,
"removed": 0
},
{
"added": 0,
"count": 0,
"difference": -1,
"range": 30,
"removed": 1
}
],
"type": "CONTACT"
}
],
"runDate": "2020-07-11"
}
}
}

Human Readable Output

INVENTORY CHANGES

Note: If the range argument is specified, a list of tables containing a daily, weekly and monthly changes summary identified over the given period of time will be presented i.e. there will be an individual table for all the dates from the last run date to the date derived from the range.

Date of the run in which following changes were identified: 2020-07-11

Asset Type1 Day7 Days30 Days
DomainCount: 25Removed: 2
Difference: -2
Added: 5
Removed: 3
Difference: 2
HostAdded: 26
Count: 21134
Difference: 26
Added: 27
Difference: 27
Added: 175
Difference: 175
PageAdded: 54
Count: 321107
Difference: 54
Added: 3477
Removed: 8
Difference: 3469
Added: 17232
Removed: 143
Difference: 17089
SSL CertAdded: 14
Count: 305
Difference: 14
Added: 14
Removed: 1
Difference: 13
Added: 20
Removed: 6
Difference: 14
ASNCount: 6Added: 6
Difference: 6
IP BlockCount: 3Added: 1
Difference: 1
IP AddressAdded: 87
Count: 1744
Difference: 87
Added: 87
Difference: 87
Added: 92
Difference: 92
ContactCount: 4Removed: 1
Difference: -1

df-asset-changes


Retrieve the list of confirmed assets that have been added or removed from inventory over the given time period. Retrieve the list of asset detail changes in inventory over the given time period.

Base Command

df-asset-changes

Input

Argument NameDescriptionRequired
typeEither the type of asset or asset detail to retrieve. Valid asset types: Domain, Host, IP Address, IP Block, ASN, Page, SSL Cert, Contact. Valid asset detail types: Self Hosted Resource, ThirdParty Hosted Resource. This argument supports a single value only.Required
dateThe date of the run in which the changes were identified (YYYY-MM-DD). If not passed it would consider the most recently run date when the discovery was run on RiskIQ Digital Footprint. This argument supports a single value only.Optional
rangeThe period of time over which the changes were identified. Supported ranges are 1, 7, and 30 days. The default value for this argument from RiskIQ platform is 1. This argument supports a single value only.Optional
measureThe type of change. Valid options for asset types are Added or Removed and for asset detail types are Added or Changed. The default value for this argument from RiskIQ platform is Added. This argument supports a single value only.Optional
brandFilter changed assets based on the brand associated with the assets. This argument supports a single value only.Optional
organizationFilter changed assets based on the organization associated with the assets. This argument supports a single value only.Optional
tagFilter changed assets based on the tag associated with the assets. This argument supports a single value only.Optional
pageThe index of the page to retrieve. The index is zero based so the first page is page 0. The default value for this argument from RiskIQ platform is 0.Optional
sizeThe number of matching assets to return per page. The default value for this argument from RiskIQ platform is 20. If a large value is entered for this argument, it might take a while to fetch the response.Optional

Context Output

PathTypeDescription
Domain.NameStringThe domain name.
IP.AddressStringIP address.
URL.DataStringThe URL.
File.NameStringThe full file name (including file extension).
File.SizeNumberThe size of the file in bytes.
File.MD5StringThe MD5 hash of the file.
File.TypeStringThe file type, as determined by libmagic (same as displayed in file entries).
File.HostnameStringThe name of the host where the file was found. Should match Path.
DBotScore.IndicatorStringThe indicator that was tested.
DBotScore.TypeStringThe indicator type.
DBotScore.VendorStringThe vendor used to calculate the score.
DBotScore.ScoreNumberThe actual score.
RiskIQDigitalFootprint.AssetChanges.nameStringName of the asset.
RiskIQDigitalFootprint.AssetChanges.runDateDateThe date of the run in which the changes were identified.
RiskIQDigitalFootprint.AssetChanges.measureStringThe type of change.
RiskIQDigitalFootprint.AssetChanges.autoConfirmedBooleanWas the asset auto-confirmed.
RiskIQDigitalFootprint.AssetChanges.enterpriseBooleanHas the asset been designated as an enterprise asset.
RiskIQDigitalFootprint.AssetChanges.stateStringState of the asset.
RiskIQDigitalFootprint.AssetChanges.priorityStringPriority of the asset.
RiskIQDigitalFootprint.AssetChanges.keystoneBooleanWas the asset designated as a discovery keystone.
RiskIQDigitalFootprint.AssetChanges.typeStringType of the asset.
RiskIQDigitalFootprint.AssetChanges.descriptionStringDescription of the asset.
RiskIQDigitalFootprint.AssetChanges.hostExcludedBooleanIf true then only IP Addresses associated with confirmed IP Blocks will be included in the results. Possible values: True, False.
RiskIQDigitalFootprint.AssetChanges.idNumberID of the asset.
RiskIQDigitalFootprint.AssetChanges.createdAtDateThe date that the asset was added to inventory.
RiskIQDigitalFootprint.AssetChanges.updatedAtDateThe date of the most recent update performed by a user action.
RiskIQDigitalFootprint.AssetChanges.confidenceStringDiscovery confidence level of the asset.
RiskIQDigitalFootprint.AssetChanges.wildcardBooleanHas the asset been designated as a wildcard asset.
RiskIQDigitalFootprint.AssetChanges.discoveryRunNumberThe id of the discovery run in which the asset was discovered.
RiskIQDigitalFootprint.AssetChanges.childUrlFirstSeenDateThe date and time when the child URl was first observed.
RiskIQDigitalFootprint.AssetChanges.childUrlLastSeenDateThe date and time when the child URL was most recently observed.
RiskIQDigitalFootprint.AssetChanges.resourceFirstSeenDateThe date and time when the resource was first observed.
RiskIQDigitalFootprint.AssetChanges.resourceLastSeenDateThe date and time when the resource was most recently observed.
RiskIQDigitalFootprint.AssetChanges.dynamicScoreNumberThe dynamic score of the asset.
RiskIQDigitalFootprint.AssetChanges.originalUrlStringThe original URL of the asset.
RiskIQDigitalFootprint.AssetChanges.firstSeenResourceGuidStringResource GUID that was first observed for the asset.
RiskIQDigitalFootprint.AssetChanges.lastSeenResourceGuidStringResource GUID that was most recently observed for the asset.
RiskIQDigitalFootprint.AssetChanges.firstSeenCrawlGuidStringCrawl GUID that was first observed for the asset.
RiskIQDigitalFootprint.AssetChanges.lastSeenCrawlGuidStringCrawl GUID that was most recently observed for the asset.
RiskIQDigitalFootprint.AssetChanges.firstSeenPageGuidStringPage GUID that was first observed for the asset.
RiskIQDigitalFootprint.AssetChanges.lastSeenPageGuidStringPage GUID that was most recently observed for the asset.
RiskIQDigitalFootprint.AssetChanges.contentTypeStringThe content type of the resource included in the asset.
RiskIQDigitalFootprint.AssetChanges.responseBodySizeStringThe response body size of the resource included in the asset.
RiskIQDigitalFootprint.AssetChanges.md5StringThe md5 hash of the content of the resource included in the asset.
RiskIQDigitalFootprint.AssetChanges.resourceStringThe url of the resource included in the asset.
RiskIQDigitalFootprint.AssetChanges.resourceHostStringThe hostname of the resource included in the asset.
RiskIQDigitalFootprint.AssetChanges.microDeltaTypeStringThe type of the resource included in the asset.
RiskIQDigitalFootprint.AssetChanges.sourceStringIf the source of the asset is known.
RiskIQDigitalFootprint.AssetChanges.organizations.createdAtDateDate and Time when the organization applied to the asset was created.
RiskIQDigitalFootprint.AssetChanges.organizations.updatedAtDateDate and Time when the organization applied to the asset was updated.
RiskIQDigitalFootprint.AssetChanges.organizations.statusStringStatus of the organization applied to the asset.
RiskIQDigitalFootprint.AssetChanges.organizations.workspaceOrganizationIDNumberID of the organization applied to the asset in the user's workspace.
RiskIQDigitalFootprint.AssetChanges.organizations.workspaceIDNumberID of the user's workspace.
RiskIQDigitalFootprint.AssetChanges.organizations.nameStringName of the organization applied to the asset.
RiskIQDigitalFootprint.AssetChanges.organizations.idNumberID of the organization applied to the asset.
RiskIQDigitalFootprint.AssetChanges.tags.createdAtDateDate and Time when the tag applied to the asset was created.
RiskIQDigitalFootprint.AssetChanges.tags.updatedAtDateDate and Time when the tag applied to the asset was updated.
RiskIQDigitalFootprint.AssetChanges.tags.statusStringStatus of the tag applied to the asset.
RiskIQDigitalFootprint.AssetChanges.tags.workspaceOrganizationIDNumberID of the tag applied to the asset in the user's workspace.
RiskIQDigitalFootprint.AssetChanges.tags.workspaceIDNumberID of the user's workspace.
RiskIQDigitalFootprint.AssetChanges.tags.workspaceTagTypeStringWorkspace type of the tag applied to the asset.
RiskIQDigitalFootprint.AssetChanges.tags.colorStringColor of the tag applied to the asset.
RiskIQDigitalFootprint.AssetChanges.tags.nameStringName of the tag applied to the asset.
RiskIQDigitalFootprint.AssetChanges.tags.idNumberID of the tag applied to the asset.
RiskIQDigitalFootprint.AssetChanges.brands.createdAtDateDate and Time when the brand applied to the asset was created.
RiskIQDigitalFootprint.AssetChanges.brands.updatedAtDateDate and Time when the brand applied to the asset was updated.
RiskIQDigitalFootprint.AssetChanges.brands.statusStringStatus of the brand applied to the asset.
RiskIQDigitalFootprint.AssetChanges.brands.workspaceOrganizationIDNumberID of the brand applied to the asset in the user's workspace.
RiskIQDigitalFootprint.AssetChanges.brands.workspaceIDNumberID of the user's workspace.
RiskIQDigitalFootprint.AssetChanges.brands.nameStringName of the brand applied to the asset.
RiskIQDigitalFootprint.AssetChanges.brands.idNumberID of the brand applied to the asset.

Command Example

!df-asset-changes type="Page" range="30" size="2"

Context Example

{
"DBotScore": [
{
"Indicator": "http://dummy.com/",
"Score": 0,
"Type": "url",
"Vendor": "RiskIQ Digital Footprint"
},
{
"Indicator": "http://dummy1.com/",
"Score": 0,
"Type": "url",
"Vendor": "RiskIQ Digital Footprint"
}
],
"RiskIQDigitalFootprint": {
"AssetChanges": [
{
"autoConfirmed": false,
"description": "http://dummy.com/",
"enterprise": false,
"keystone": false,
"measure": "added",
"name": "http://dummy.com/",
"priority": "NONE",
"runDate": "2020-07-11",
"source": false,
"state": "CONFIRMED",
"type": "PAGE",
"wildcard": false
},
{
"autoConfirmed": false,
"description": "http://dummy1.com/",
"enterprise": false,
"keystone": false,
"measure": "added",
"name": "http://dummy1.com/",
"priority": "NONE",
"runDate": "2020-07-11",
"source": false,
"state": "CONFIRMED",
"type": "PAGE",
"wildcard": false
}
]
},
"URL": [
{
"Data": "http://dummy.com/"
},
{
"Data": "http://dummy1.com/"
}
]
}

Human Readable Output

INVENTORY CHANGES: DETAILS

Added Inventory Assets: 2

Total: 600

Fetched: 2

NameDescriptionStatePriorityMeasureRunDate
http://dummy.com/http://dummy.com/CONFIRMEDNONEadded2020-07-11
http://dummy1.com/http://dummy1.com/CONFIRMEDNONEadded2020-07-11

df-get-asset


Retrieve the asset of the specified UUID or type and name from Global Inventory.

Base Command

df-get-asset

Input

Argument NameDescriptionRequired
uuidThe unique identifier of an asset in global inventory. This argument supports a single value only.Optional
nameThe name of the asset to retrieve. For example riskiq.com, 8.8.8.8, mail.net, etc. This argument supports a single value only.Optional
typeThe type of the asset to retrieve. Valid Types: Domain, Host, IP Address, IP Block, ASN, Page, SSL Cert, Contact. This argument supports a single value only.Optional
globalSetting this value to true will search all of the global inventory. Setting it to false will search for assets in the workspace associated with the authentication token. The default value for this argument from RiskIQ platform is false. This argument supports a single value only.Optional
recentIf specified and 'true', then only return recent data on the asset. The default value for this argument from RiskIQ platform is false. This argument supports a single value only.Optional
sizeDigital Footprint (Global Inventory) assets potentially contain pages of related data, for example attributes, cookies and host pairs. Size determines the number for each of these associated items that are returned. If a large value is entered for this argument, it might take a while to fetch the response.Optional

Context Output

PathTypeDescription
Domain.NameStringThe domain name.
Domain.OrganizationStringThe organization of the domain.
Domain.DomainStatusStringThe status of the domain.
Domain.NameServersStringName servers of the domain
Domain.Registrant.CountryStringThe country of the domain registrant.
Domain.Registrant.EmailStringThe email address of the domain registrant.
Domain.Registrant.NameStringThe name of the domain registrant.
Domain.Registrant.PhoneStringThe phone number of the domain registrant.
Domain.Registrar.NameStringThe name of the registrar, for example: "GoDaddy".
Domain.Registrar.AbuseEmailStringThe email address of the contact for reporting abuse.
Domain.Registrar.AbusePhoneStringThe phone number of contact for reporting abuse.
Domain.Admin.CountryStringThe country of the domain administrator.
Domain.Admin.EmailStringThe email address of the domain administrator.
Domain.Admin.NameStringThe name of the domain administrator.
Domain.Admin.PhoneStringThe phone number of the domain administrator.
Domain.WHOIS.DomainStatusStringThe status of the domain.
Domain.WHOIS.NameServersStringA list of name servers, for example: "ns1.bla.com, ns2.bla.com".
Domain.WHOIS.Registrant.CountryStringThe country of the domain registrant.
Domain.WHOIS.Registrant.EmailStringThe email address of the domain registrant.
Domain.WHOIS.Registrant.NameStringThe name of the domain registrant.
Domain.WHOIS.Registrant.PhoneStringThe phone number of the domain registrant.
Domain.WHOIS.Registrar.NameStringThe name of the registrar, for example: "GoDaddy".
Domain.WHOIS.Registrar.AbuseEmailStringThe email address of the contact for reporting abuse.
Domain.WHOIS.Registrar.AbusePhoneStringThe phone number of contact for reporting abuse.
Domain.WHOIS.Admin.CountryStringThe country of the domain administrator.
Domain.WHOIS.Admin.EmailStringThe email address of the domain administrator.
Domain.WHOIS.Admin.NameStringThe name of the domain administrator.
Domain.WHOIS.Admin.PhoneStringThe phone number of the domain administrator.
IP.AddressStringIP address.
IP.ASNStringThe autonomous system name for the IP address, for example: "AS8948".
CVE.IDStringThe ID of the CVE, for example: CVE-2015-1653
CVE.CVSSStringThe CVSS of the CVE, for example: 10.0
URL.DataStringThe URL.
DBotScore.IndicatorStringThe indicator that was tested.
DBotScore.TypeStringThe indicator type.
DBotScore.VendorStringThe vendor used to calculate the score.
DBotScore.ScoreNumberThe actual score.
RiskIQDigitalFootprint.Asset.nameStringName of the asset.
RiskIQDigitalFootprint.Asset.typeStringType of the asset.
RiskIQDigitalFootprint.Asset.firstSeenDateDate and Time when the asset was first observed.
RiskIQDigitalFootprint.Asset.lastSeenDateDate and Time when the asset was most recently observed.
RiskIQDigitalFootprint.Asset.uuidStringUUID of the asset.
RiskIQDigitalFootprint.Asset.labelStringLabel of the asset.
RiskIQDigitalFootprint.Asset.descriptionStringDescription of the asset.
RiskIQDigitalFootprint.Asset.autoConfirmedBooleanWas the asset auto-confirmed.
RiskIQDigitalFootprint.Asset.enterpriseBooleanHas the asset been designated as an enterprise asset.
RiskIQDigitalFootprint.Asset.stateStringState of the asset.
RiskIQDigitalFootprint.Asset.priorityStringPriority of the asset.
RiskIQDigitalFootprint.Asset.keystoneBooleanWas the asset designated as a discovery keystone.
RiskIQDigitalFootprint.Asset.hostExcludedBooleanIf true then only IP Addresses associated with confirmed IP Blocks will be included in the results. Possible values: True, False.
RiskIQDigitalFootprint.Asset.idNumberID of the asset.
RiskIQDigitalFootprint.Asset.createdAtDateThe date that the asset was added to inventory.
RiskIQDigitalFootprint.Asset.updatedAtDateThe date of the most recent update was performed on the asset by a user action.
RiskIQDigitalFootprint.Asset.confidenceStringDiscovery confidence level of the asset.
RiskIQDigitalFootprint.Asset.sourceStringIf the source of the asset is known.
RiskIQDigitalFootprint.Asset.organizations.createdAtDateDate and Time when the organization applied to the asset was created.
RiskIQDigitalFootprint.Asset.organizations.updatedAtDateDate and Time when the organization applied to the asset was updated.
RiskIQDigitalFootprint.Asset.organizations.statusStringStatus of the organization applied to the asset.
RiskIQDigitalFootprint.Asset.organizations.workspaceOrganizationIDNumberID of the organization applied to the asset in the user's workspace.
RiskIQDigitalFootprint.Asset.organizations.workspaceIDNumberID of the user's workspace.
RiskIQDigitalFootprint.Asset.organizations.nameStringName of the organization applied to the asset.
RiskIQDigitalFootprint.Asset.organizations.idNumberID of the organization applied to the asset.
RiskIQDigitalFootprint.Asset.tags.createdAtDateDate and Time when the tag applied to the asset was created.
RiskIQDigitalFootprint.Asset.tags.updatedAtDateDate and Time when the tag applied to the asset was updated.
RiskIQDigitalFootprint.Asset.tags.statusStringStatus of the tag applied to the asset.
RiskIQDigitalFootprint.Asset.tags.workspaceOrganizationIDNumberID of the tag applied to the asset in the user's workspace.
RiskIQDigitalFootprint.Asset.tags.workspaceIDNumberID of the user's workspace.
RiskIQDigitalFootprint.Asset.tags.workspaceTagTypeStringWorkspace type of the tag applied to the asset.
RiskIQDigitalFootprint.Asset.tags.colorStringColor of the tag applied to the asset.
RiskIQDigitalFootprint.Asset.tags.nameStringName of the tag applied to the asset.
RiskIQDigitalFootprint.Asset.tags.idNumberID of the tag applied to the asset.
RiskIQDigitalFootprint.Asset.brands.createdAtDateDate and Time when the brand applied to the asset was created.
RiskIQDigitalFootprint.Asset.brands.updatedAtDateDate and Time when the brand applied to the asset was updated.
RiskIQDigitalFootprint.Asset.brands.statusStringStatus of the brand applied to the asset.
RiskIQDigitalFootprint.Asset.brands.workspaceOrganizationIDNumberID of the brand applied to the asset in the user's workspace.
RiskIQDigitalFootprint.Asset.brands.workspaceIDNumberID of the user's workspace.
RiskIQDigitalFootprint.Asset.brands.nameStringName of the brand applied to the asset.
RiskIQDigitalFootprint.Asset.brands.idNumberID of the brand applied to the asset.
RiskIQDigitalFootprint.Asset.auditTrail.nameStringName of audit trail detected for the requested asset.
RiskIQDigitalFootprint.Asset.auditTrail.typeStringType of audit trail detected for the requested asset.
RiskIQDigitalFootprint.Asset.auditTrail.descriptionStringDescription of audit trail detected for the requested asset.
RiskIQDigitalFootprint.Asset.primaryContact.contactIDNumberContact ID of primary contact of the requested asset.
RiskIQDigitalFootprint.Asset.primaryContact.firstNameStringFirst name of primary contact of the requested asset.
RiskIQDigitalFootprint.Asset.primaryContact.lastNameStringLast name of primary contact of the requested asset.
RiskIQDigitalFootprint.Asset.primaryContact.fullNameStringFull name of primary contact of the requested asset.
RiskIQDigitalFootprint.Asset.primaryContact.emailStringEmail of primary contact of the requested asset.
RiskIQDigitalFootprint.Asset.primaryContact.userIdStringUser ID of primary contact of the requested asset.
RiskIQDigitalFootprint.Asset.primaryContact.nameStringName of primary contact of the requested asset.
RiskIQDigitalFootprint.Asset.primaryContact.idStringID of primary contact of the requested asset.
RiskIQDigitalFootprint.Asset.secondaryContact.contactIDNumberContact ID of secondary contact of the requested asset.
RiskIQDigitalFootprint.Asset.secondaryContact.firstNameStringFirst name of secondary contact of the requested asset.
RiskIQDigitalFootprint.Asset.secondaryContact.lastNameStringLast name of secondary contact of the requested asset.
RiskIQDigitalFootprint.Asset.secondaryContact.fullNameStringFull name of secondary contact of the requested asset.
RiskIQDigitalFootprint.Asset.secondaryContact.emailStringEmail of secondary contact of the requested asset.
RiskIQDigitalFootprint.Asset.secondaryContact.userIdStringUser ID of secondary contact of the requested asset.
RiskIQDigitalFootprint.Asset.secondaryContact.nameStringName of secondary contact of the requested asset.
RiskIQDigitalFootprint.Asset.secondaryContact.idStringID of secondary contact of the requested asset.
RiskIQDigitalFootprint.Asset.externalIDStringExternal ID of the requested asset.
RiskIQDigitalFootprint.Asset.externalMetadataStringExternal metadata of the requested asset.
RiskIQDigitalFootprint.Asset.noteStringNote of the requested asset.
RiskIQDigitalFootprint.Asset.removedStateStringState of the asset after removing that asset from the inventory.
RiskIQDigitalFootprint.Asset.wildcardBooleanHas the asset been designated as a wildcard asset.
RiskIQDigitalFootprint.Asset.assetDomainStringDomain of the asset.
RiskIQDigitalFootprint.Asset.assetWhoisIdNumberWhois ID of the domain.
RiskIQDigitalFootprint.Asset.assetRegistrarIanaIds.valueNumberThe IANA id associated with the domain registrar.
RiskIQDigitalFootprint.Asset.assetRegistrarIanaIds.firstSeenDateDate and Time when the Registrar IanaID of the domain was first observed.
RiskIQDigitalFootprint.Asset.assetRegistrarIanaIds.lastSeenDateDate and Time when the Registrar IanaID of the domain was most recently observed.
RiskIQDigitalFootprint.Asset.assetRegistrarIanaIds.recentBooleanIf the Registrar IanaID of the domain is recent.
RiskIQDigitalFootprint.Asset.assetRegistrarIanaIds.currentBooleanIf the Registrar IanaID of the domain is current.
RiskIQDigitalFootprint.Asset.assetRegistrantContacts.valueStringRegistrant Contact of the domain.
RiskIQDigitalFootprint.Asset.assetRegistrantContacts.firstSeenDateDate and Time when the Registrant Contact of the domain was first observed.
RiskIQDigitalFootprint.Asset.assetRegistrantContacts.lastSeenDateDate and Time when the Registrant Contact of the domain was most recently observed.
RiskIQDigitalFootprint.Asset.assetRegistrantContacts.recentBooleanIf the Registrant Contact of the domain is recent.
RiskIQDigitalFootprint.Asset.assetRegistrantContacts.currentBooleanIf the Registrant Contact of the domain is current.
RiskIQDigitalFootprint.Asset.assetRegistrantOrgs.valueStringRegistrant Organization of the domain.
RiskIQDigitalFootprint.Asset.assetRegistrantOrgs.firstSeenDateDate and Time when the Registrant Organization of the asset was first observed.
RiskIQDigitalFootprint.Asset.assetRegistrantOrgs.lastSeenDateDate and Time when the Registrant Organization of the asset was last seen.
RiskIQDigitalFootprint.Asset.assetRegistrantOrgs.recentBooleanIf the Registrant Organization of the asset is recent.
RiskIQDigitalFootprint.Asset.assetRegistrantOrgs.currentBooleanIf the Registrant Organization of the asset is current.
RiskIQDigitalFootprint.Asset.assetAdminContacts.valueStringAdministrator Contact of the asset.
RiskIQDigitalFootprint.Asset.assetAdminContacts.firstSeenDateDate and Time when the Administrator Contact of the asset was first observed.
RiskIQDigitalFootprint.Asset.assetAdminContacts.lastSeenDateDate and Time when the Administrator Contact of the asset was most recently observed.
RiskIQDigitalFootprint.Asset.assetAdminContacts.recentBooleanIf the Administrator Contact of the asset is recent.
RiskIQDigitalFootprint.Asset.assetAdminContacts.currentBooleanIf the Administrator Contact of the asset is current.
RiskIQDigitalFootprint.Asset.assetTechnicalContacts.valueStringTechnical Contact of the asset.
RiskIQDigitalFootprint.Asset.assetTechnicalContacts.firstSeenDateDate and Time when the Technical Contact of the asset was first observed.
RiskIQDigitalFootprint.Asset.assetTechnicalContacts.lastSeenDateDate and Time when the Technical Contact of the asset was most recently observed.
RiskIQDigitalFootprint.Asset.assetTechnicalContacts.recentBooleanIf the Technical Contact of the asset is recent.
RiskIQDigitalFootprint.Asset.assetTechnicalContacts.currentBooleanIf the Technical Contact of the asset is current.
RiskIQDigitalFootprint.Asset.assetNameServers.valueStringName Server of the asset.
RiskIQDigitalFootprint.Asset.assetNameServers.firstSeenDateDate and Time when the Name Server of the asset was first observed.
RiskIQDigitalFootprint.Asset.assetNameServers.lastSeenDateDate and Time when the Name Server of the asset was most recently observed.
RiskIQDigitalFootprint.Asset.assetNameServers.recentBooleanIf the Name Server of the asset is recent.
RiskIQDigitalFootprint.Asset.assetNameServers.currentBooleanIf the Name Server of the asset is current.
RiskIQDigitalFootprint.Asset.assetMailServers.valueStringMail Server of the asset.
RiskIQDigitalFootprint.Asset.assetMailServers.firstSeenDateDate and Time when the Mail Server of the asset was first observed.
RiskIQDigitalFootprint.Asset.assetMailServers.lastSeenDateDate and Time when the Mail Server of the asset was most recently observed.
RiskIQDigitalFootprint.Asset.assetMailServers.recentBooleanIf the Mail Server of the asset is recent.
RiskIQDigitalFootprint.Asset.assetMailServers.currentBooleanIf the Mail Server of the asset is current.
RiskIQDigitalFootprint.Asset.assetWhoisServers.valueStringWhois Server of the domain.
RiskIQDigitalFootprint.Asset.assetWhoisServers.firstSeenDateDate and Time when the Whois Server of the domain was first observed.
RiskIQDigitalFootprint.Asset.assetWhoisServers.lastSeenDateDate and Time when the Whois Server of the domain was most recently observed.
RiskIQDigitalFootprint.Asset.assetWhoisServers.recentBooleanIf the Whois Server of the domain is recent.
RiskIQDigitalFootprint.Asset.assetWhoisServers.currentBooleanIf the Whois Server of the domain is current.
RiskIQDigitalFootprint.Asset.assetDomainStatuses.valueStringDomain Status of the domain.
RiskIQDigitalFootprint.Asset.assetDomainStatuses.firstSeenDateDate and Time when the Domain Status of the domain was first observed.
RiskIQDigitalFootprint.Asset.assetDomainStatuses.lastSeenDateDate and Time when the Domain Status of the domain was most recently observed.
RiskIQDigitalFootprint.Asset.assetDomainStatuses.recentBooleanIf the Domain Status of the domain is recent.
RiskIQDigitalFootprint.Asset.assetDomainStatuses.currentBooleanIf the Domain Status of the domain is current.
RiskIQDigitalFootprint.Asset.assetRegistrarCreatedAt.valueDateDate and Time when the Registrar of the asset was created.
RiskIQDigitalFootprint.Asset.assetRegistrarCreatedAt.firstSeenDateDate and Time when the Registrar's created date of the asset was first observed.
RiskIQDigitalFootprint.Asset.assetRegistrarCreatedAt.lastSeenDateDate and Time when the Registrar's created date of the asset was most recently observed.
RiskIQDigitalFootprint.Asset.assetRegistrarCreatedAt.recentBooleanIf the Registrar's created date of the asset is recent.
RiskIQDigitalFootprint.Asset.assetRegistrarCreatedAt.currentBooleanIf the Registrar's created date of the asset is current.
RiskIQDigitalFootprint.Asset.assetRegistrarUpdatedAt.valueDateDate and Time when the Registrar of the asset was updated.
RiskIQDigitalFootprint.Asset.assetRegistrarUpdatedAt.firstSeenDateDate and Time when the Registrar's updated date of the asset was first observed.
RiskIQDigitalFootprint.Asset.assetRegistrarUpdatedAt.lastSeenDateDate and Time when the Registrar's updated date of the asset was most recently observed.
RiskIQDigitalFootprint.Asset.assetRegistrarUpdatedAt.recentBooleanIf the Registrar's updated at date of the asset is recent.
RiskIQDigitalFootprint.Asset.assetRegistrarUpdatedAt.currentBooleanIf the Registrar's updated date of the asset is current.
RiskIQDigitalFootprint.Asset.assetRegistrarExpiresAt.valueDateDate and Time when the Registrar of the domain expires at.
RiskIQDigitalFootprint.Asset.assetRegistrarExpiresAt.firstSeenDateDate and Time when the Registrar's expiry date of the domain was first observed.
RiskIQDigitalFootprint.Asset.assetRegistrarExpiresAt.lastSeenDateDate and Time when the Registrar's expiry date of the domain was most recently observed.
RiskIQDigitalFootprint.Asset.assetRegistrarExpiresAt.recentBooleanIf the Registrar's expiry date of the domain is recent.
RiskIQDigitalFootprint.Asset.assetRegistrarExpiresAt.currentBooleanIf the Registrar's expiry date of the domain is current.
RiskIQDigitalFootprint.Asset.assetSoaRecords.nameServerStringName Server for the SOA record of the domain.
RiskIQDigitalFootprint.Asset.assetSoaRecords.emailStringEmail for the SOA record of the domain.
RiskIQDigitalFootprint.Asset.assetSoaRecords.firstSeenDateDate and Time when the SOA record of the domain was first observed.
RiskIQDigitalFootprint.Asset.assetSoaRecords.lastSeenDateDate and Time when the SOA record of the domain was most recently observed.
RiskIQDigitalFootprint.Asset.assetSoaRecords.serialNumberNumberSerial Number for the SOA record of the domain.
RiskIQDigitalFootprint.Asset.assetSoaRecords.recentBooleanIf the SOA record of the domain is recent.
RiskIQDigitalFootprint.Asset.assetSoaRecords.currentBooleanIf the SOA record of the domain is current.
RiskIQDigitalFootprint.Asset.assetDetailedFromWhoisAtDateDate and Time when the details from the whois was fetched.
RiskIQDigitalFootprint.Asset.assetRegistrarNames.valueStringRegistrar Name of the domain.
RiskIQDigitalFootprint.Asset.assetRegistrarNames.firstSeenDateDate and Time when the Registrar Name of the domain was first observed.
RiskIQDigitalFootprint.Asset.assetRegistrarNames.lastSeenDateDate and Time when the Registrar Name of the domain was most recently observed.
RiskIQDigitalFootprint.Asset.assetRegistrarNames.recentBooleanIf the Registrar Name of the domain is recent.
RiskIQDigitalFootprint.Asset.assetRegistrarNames.currentBooleanIf the Registrar Name of the domain is current.
RiskIQDigitalFootprint.Asset.assetFirstSeenDateDate and Time when the asset was first observed.
RiskIQDigitalFootprint.Asset.assetLastSeenDateDate and Time when the asset was most recently observed.
RiskIQDigitalFootprint.Asset.assetCountNumberCount for the number of times this asset has been observed.
RiskIQDigitalFootprint.Asset.assetParkedDomain.valueBooleanHas the domain been identified as parked.
RiskIQDigitalFootprint.Asset.assetParkedDomain.firstSeenDateDate and Time when the Parked domain value for the domain was first observed.
RiskIQDigitalFootprint.Asset.assetParkedDomain.lastSeenDateDate and Time when the Parked domain value for the domain was most recently observed.
RiskIQDigitalFootprint.Asset.assetParkedDomain.recentBooleanIf the Parked domain value for the domain is recent.
RiskIQDigitalFootprint.Asset.assetParkedDomain.currentBooleanIf the Parked domain value for the domain is current.
RiskIQDigitalFootprint.Asset.assetAlexaRankStringAlexa Rank of the asset.
RiskIQDigitalFootprint.Asset.whoisCreatedAtDateDate and Time when the whois details of the asset was first observed.
RiskIQDigitalFootprint.Asset.whoisUpdatedAtDateDate and Time when the whois details of the asset was most recently observed.
RiskIQDigitalFootprint.Asset.whoisStatusStringWhois Status of the asset.
RiskIQDigitalFootprint.Asset.whoisIDNumberWhois ID of the asset.
RiskIQDigitalFootprint.Asset.whoisDomainStringDomain fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisDomainMd5StringDomain MD5 fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisDomainUnicodeStringDomain Unicode fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisTldStringWhois TLD of the asset.
RiskIQDigitalFootprint.Asset.whoisNameserversStringName servers fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisServerStringWhois server fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrantAddressStringAddress of the Registrant fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrantCityStringCity of the Registrant fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrantCountryStringCountry of the Registrant fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrantEmailStringEmail address of the Registrant fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrantFaxStringFax of the Registrant fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrantIdNumberID of the Registrant fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrantNameStringName of the Registrant fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrantOrganizationStringOrganization of the Registrant fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrantPhoneStringPhone number of the Registrant fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrantStateStringState of the Registrant fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrantStreetStringStreet of the Registrant fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrantWhoisContactIDNumberWhois Contact ID of the Registrant fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrantZipStringZip code of the Registrant fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrarIanaIDNumberThe IANA id associated with the domain registrar fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrarCreatedAtDateDate and Time when Registrar was created fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrarUpdatedAtDateDate and Time when Registrar was updated fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrarExpiresAtDateDate and Time when Registrar expires fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrarAddressStringAddress of the Registrar fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrarCityStringCity of the Registrar fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrarCountryStringCountry of the Registrar fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrarEmailStringEmail address of the Registrar fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrarFaxStringFax of the Registrar fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrarIdNumberID of the Registrar fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrarNameStringName of the Registrar fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrarOrganizationStringOrganization of the Registrar fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrarPhoneStringPhone number of the Registrar fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrarStateStringState of the Registrar fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrarStreetStringStreet of the Registrar fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrarWhoisContactIDNumberWhois Contact ID of the Registrar fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrarZipStringZip code of the Registrar fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrar.addressStringAddress of the Registrar fetched from registrar details of whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrar.cityStringCity of the Registrar fetched from registrar details of whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrar.countryStringCountry of the Registrar fetched from registrar details of whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrar.emailStringEmail address of the Registrar fetched from registrar details of whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrar.faxStringFax of the Registrar fetched from registrar details of whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrar.idNumberID of the Registrar fetched from registrar details of whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrar.nameStringName of the Registrar fetched from registrar details of whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrar.organizationStringOrganization of the Registrar fetched from registrar details of whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrar.phoneStringPhone number of the Registrar fetched from registrar details of whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrar.stateStringState of the Registrar fetched from registrar details of whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrar.streetStringStreet of the Registrar fetched from registrar details of whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrar.whoisContactIDNumberWhois Contact ID of the Registrar fetched from registrar details of whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrar.zipStringZip code of the Registrar fetched from registrar details of whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisAdminAddressStringAddress of the Administrator fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisAdminCityStringCity of the Administrator fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisAdminCountryStringCountry of the Administrator fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisAdminEmailStringEmail address of the Administrator fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisAdminFaxStringFax of the Administrator fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisAdminIdNumberID of the Administrator fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisAdminNameStringName of the Administrator fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisAdminOrganizationStringOrganization of the Administrator fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisAdminPhoneStringPhone number of the Administrator fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisAdminStateStringState of the Administrator fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisAdminStreetStringStreet of the Administrator fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisAdminWhoisContactIDNumberWhois Contact ID of the Administrator fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisAdminZipStringZip code of the Administrator fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisAuditCreatedAtDateDate and Time when the whois audit was created.
RiskIQDigitalFootprint.Asset.whoisAuditUpdatedAtDateDate and Time when the whois audit was updated.
RiskIQDigitalFootprint.Asset.whoisBillingAddressStringAddress of the Billing contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisBillingCityStringCity of the Billing contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisBillingCountryStringCountry of the Billing contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisBillingEmailStringEmail address of the Billing contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisBillingFaxStringFax of the Billing contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisBillingIdNumberID of the Billing contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisBillingNameStringName of the Billing contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisBillingOrganizationStringOrganization of the Billing contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisBillingPhoneStringPhone of the Billing contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisBillingStateStringState of the Billing contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisBillingStreetStringStreet of the Billing contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisBillingWhoisContactIDNumberWhois Contact ID of the Billing contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisBillingZipStringZip code of the Billing contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisCompositeParseCodeNumberComposite Parse code fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisContactCountriesStringContact Countries fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisContactOrganizationsStringContact Organizations fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisContactEmailsStringContact Emails fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisContactNamesStringContact Names fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisContacts.addressStringAddress of Whois Contact of the asset.
RiskIQDigitalFootprint.Asset.whoisContacts.stateStringState of Whois Contact of the asset.
RiskIQDigitalFootprint.Asset.whoisContacts.streetStringStreet of Whois Contact of the asset.
RiskIQDigitalFootprint.Asset.whoisContacts.emailStringEmail of Whois Contact of the asset.
RiskIQDigitalFootprint.Asset.whoisContacts.phoneStringPhone of Whois Contact of the asset.
RiskIQDigitalFootprint.Asset.whoisContacts.faxStringFax of Whois Contact of the asset.
RiskIQDigitalFootprint.Asset.whoisContacts.nameStringName of Whois Contact of the asset.
RiskIQDigitalFootprint.Asset.whoisContacts.zipStringZip of Whois Contact of the asset.
RiskIQDigitalFootprint.Asset.whoisContacts.countryStringCountry of Whois Contact of the asset.
RiskIQDigitalFootprint.Asset.whoisContacts.idNumberID of Whois Contact of the asset.
RiskIQDigitalFootprint.Asset.whoisContacts.organizationStringOrganization of Whois Contact of the asset.
RiskIQDigitalFootprint.Asset.whoisContacts.stateStringState of Whois Contact of the asset.
RiskIQDigitalFootprint.Asset.whoisContacts.whoisContactIDNumberWhois Contact ID of Whois Contact of the asset.
RiskIQDigitalFootprint.Asset.whoisDomainAvailableBooleanIf the domain is available fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisDomainStatusStringDomain Status fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisExpiredBooleanIf Whois is expired fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisIdNumberID fetched from the whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisNoRecordBooleanIf there is no whois record for the asset.
RiskIQDigitalFootprint.Asset.whoisRegistrarParseCodeNumberParse Code of Registrar fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisRegistryParseCodeNumberParse Code of Registry fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisTechnicalAddressStringAddress of the Technical contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisTechnicalCityStringCity of the Technical contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisTechnicalCountryStringCountry of the Technical contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisTechnicalEmailStringEmail address of the Technical contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisTechnicalFaxStringFax of the Technical contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisTechnicalIdNumberID of the Technical contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisTechnicalNameStringName of the Technical contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisTechnicalOrganizationStringOrganization of the Technical contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisTechnicalPhoneStringPhone number of the Technical contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisTechnicalStreetStringStreet of the Technical contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisTechnicalWhoisContactIDNumberWhois Contact ID of the Technical contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.whoisTechnicalZipStringZip code of the Technical contact fetched from whois details of the asset.
RiskIQDigitalFootprint.Asset.assetHostStringHost of the asset.
RiskIQDigitalFootprint.Asset.assetIpAddresses.valueStringIP address which the host has resolved to.
RiskIQDigitalFootprint.Asset.assetIpAddresses.firstSeenDateDate and Time when the IP Address of the asset was first observed.
RiskIQDigitalFootprint.Asset.assetIpAddresses.lastSeenDateDate and Time when the IP Address of the asset was most recently observed.
RiskIQDigitalFootprint.Asset.assetIpAddresses.recentBooleanIf the IP Address of the asset is recent.
RiskIQDigitalFootprint.Asset.assetIpAddresses.currentBooleanIf the IP Address of the asset is current.
RiskIQDigitalFootprint.Asset.assetIpAddresses.countNumberThe number of times that IP Address is observed for this asset.
RiskIQDigitalFootprint.Asset.assetWebComponents.firstSeenDateDate and Time when the web component was first observed on the asset.
RiskIQDigitalFootprint.Asset.assetWebComponents.lastSeenDateDate and Time when the web component was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.assetWebComponents.recentBooleanIf the web component observed on the asset is recent.
RiskIQDigitalFootprint.Asset.assetWebComponents.ports.portNumberPort on which the web component observed on the asset is running.
RiskIQDigitalFootprint.Asset.assetWebComponents.ports.firstSeenDateDate and Time when the port value for the web component observed on the asset was first observed.
RiskIQDigitalFootprint.Asset.assetWebComponents.ports.lastSeenDateDate and Time when the port value for the web component observed on the asset was most recently observed.
RiskIQDigitalFootprint.Asset.assetWebComponents.ports.countNumberThe number of times the port was observed for that web component observed on the asset.
RiskIQDigitalFootprint.Asset.assetWebComponents.webComponentNameStringName of web component observed on the asset.
RiskIQDigitalFootprint.Asset.assetWebComponents.webComponentCategoryStringCategory of web component observed on the asset.
RiskIQDigitalFootprint.Asset.assetWebComponents.webComponentVersionStringVersion of web component observed on the asset.
RiskIQDigitalFootprint.Asset.assetWebComponents.cves.nameStringThe id of a CVE identified on the web component observed on the asset.
RiskIQDigitalFootprint.Asset.assetWebComponents.cves.cvssScoreNumberCVSS score reflecting the severity of a CVE found on the web component observed on the asset.
RiskIQDigitalFootprint.Asset.assetWebComponents.cves.cweIDStringThe id of a CWE identified on the web component observed on the asset.
RiskIQDigitalFootprint.Asset.assetWebComponents.currentNumberIf the web component observed on the asset is current.
RiskIQDigitalFootprint.Asset.assetHeaders.headerNameStringName of the header observed on the asset.
RiskIQDigitalFootprint.Asset.assetHeaders.headerValueStringValue of the header observed on the asset.
RiskIQDigitalFootprint.Asset.assetHeaders.firstSeenDateDate and Time when the header was first observed on the asset.
RiskIQDigitalFootprint.Asset.assetHeaders.lastSeenDateDate and Time when the header was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.assetHeaders.recentNumberIf the header observed on the asset is recent.
RiskIQDigitalFootprint.Asset.assetHeaders.currentNumberIf the header observed on the asset is current.
RiskIQDigitalFootprint.Asset.assetAttributes.attributeTypeStringAttribute/Tracker type observed on the asset.
RiskIQDigitalFootprint.Asset.assetAttributes.attributeValueStringAttribute/Tracker value observed on the asset.
RiskIQDigitalFootprint.Asset.assetAttributes.firstSeenDateDate and Time when the attribute/tracker was first observed on the asset.
RiskIQDigitalFootprint.Asset.assetAttributes.lastSeenDateDate and Time when the attribute/tracker was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.assetAttributes.recentNumberIf the attribute/tracker observed on the asset is recent.
RiskIQDigitalFootprint.Asset.assetAttributes.currentNumberIf the attribute/tracker observed on the asset is current.
RiskIQDigitalFootprint.Asset.assetCookies.cookieNameStringName of the cookie observed on the asset.
RiskIQDigitalFootprint.Asset.assetCookies.cookieDomainStringDomain of the cookie observed on the asset.
RiskIQDigitalFootprint.Asset.assetCookies.firstSeenDateDate and Time when the cookie was first observed on the asset.
RiskIQDigitalFootprint.Asset.assetCookies.lastSeenDateDate and Time when the cookie was most recently seen on the asset.
RiskIQDigitalFootprint.Asset.assetCookies.recentNumberIf the cookie observed on the asset is recent.
RiskIQDigitalFootprint.Asset.assetCookies.currentNumberIf the cookie observed on the asset is current.
RiskIQDigitalFootprint.Asset.assetSslCerts.sha1StringSHA1 of the SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.serialNumberStringSerial number of the SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.subjectAlternativeNamesStringSubject alternative names of the SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.issuerAlternativeNamesStringIssuer alternative names of the SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.firstSeenDateDate and Time when the SSL certificate was first observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.lastSeenDateDate and Time when the SSL certificate was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.keySizeNumberKey size of the SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.versionNumberVersion of the SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.certificateAuthorityBooleanIf the authority of the SSL certificate observed on the asset is certified.
RiskIQDigitalFootprint.Asset.assetSslCerts.selfSignedBooleanIf the SSL certificate observed on the asset is self signed.
RiskIQDigitalFootprint.Asset.assetSslCerts.recentBooleanIf the SSL certificate of the asset is recent.
RiskIQDigitalFootprint.Asset.assetSslCerts.signatureAlgorithmStringSignature Algorithm of the SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.signatureAlgorithmOidStringSignature Algorithm OID of the SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.notBeforeDateDate and Time before which the SSL certificate observed on the asset is invalid.
RiskIQDigitalFootprint.Asset.assetSslCerts.notAfterDateDate and Time after which the SSL certificate observed on the asset is invalid.
RiskIQDigitalFootprint.Asset.assetSslCerts.publicKeyAlgorithmStringPublic Key Algorithm of the SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.idStringID of the SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.issuer.countryStringCountry of the issuer of SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.issuer.unitStringOrganization unit of the issuer of SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.issuer.organizationStringOrganization of the issuer of SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.issuer.commonnameStringCommon Name of the issuer of SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.subject.stateStringState of the issuer of SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.subject.localeStringLocale of the issuer of SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.subject.countryStringCountry of the subject of SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.subject.unitStringOrganization Unit of the subject of SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.subject.organizationStringOrganization of the subject of SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.subject.commonnameStringCommon Name of the subject of SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.subject.stateStringState of the subject of SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.subject.localeStringLocale of the subject of SSL certificate observed on the asset.
RiskIQDigitalFootprint.Asset.assetSslCerts.currentBooleanIf the ssl certificate observed on the asset is current.
RiskIQDigitalFootprint.Asset.assetHostCore.hostStringHost observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostCore.domainStringDomain observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostCore.firstSeenDateDate and Time when the host was first observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostCore.lastSeenDateDate and Time when the host was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostCore.countNumberNumber of times the host was observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostCore.blacklistSequenceCountNumberBlack list sequence count of the host observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostCore.phishSequenceCountNumberPhish sequence count of the host observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostCore.malwareSequenceCountNumberMalware sequence count of the host observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostCore.spamSequenceCountNumberSpam sequence count of the host observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostCore.scamSequenceCountNumberScam sequence count of the host observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostCore.hostReputationScoreNumberReputation score of the host observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostCore.hostPhishReputationScoreNumberPhish Reputation score of the host observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostCore.hostMalwareReputationScoreNumberMalware Reputation score of the host observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostCore.hostSpamReputationScoreNumberHost Spam Reputation score of the host observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostCore.hostScamReputationScoreNumberHost Scam Reputation score of the host observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostCore.domainReputationScoreNumberDomain Reputation score of the host observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostCore.domainPhishReputationScoreNumberDomain Phish Reputation score of the host observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostCore.domainMalwareReputationScoreNumberDomain Malware Reputation score of the host observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostCore.domainSpamReputationScoreNumberDomain Spam Reputation score of the host observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostCore.domainScamReputationScoreNumberDomain Scam Reputation score of the host observed on the asset.
RiskIQDigitalFootprint.Asset.assetServices.schemeStringScheme for the services observed on the asset.
RiskIQDigitalFootprint.Asset.assetServices.portNumberPort for the services observed on the asset.
RiskIQDigitalFootprint.Asset.assetServices.firstSeenDateDate and Time when the service was first observed on the asset.
RiskIQDigitalFootprint.Asset.assetServices.lastSeenDateDate and Time when the service was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.assetServices.recentBooleanIf the service observed on the asset is recent.
RiskIQDigitalFootprint.Asset.assetServices.banners.portNumberPort for the banner of the service observed on the asset.
RiskIQDigitalFootprint.Asset.assetServices.banners.bannerStringBanner of the service observed on the asset.
RiskIQDigitalFootprint.Asset.assetServices.banners.firstSeenDateDate and Time when the banner of the service was first observed on the asset.
RiskIQDigitalFootprint.Asset.assetServices.banners.lastSeenDateDate and Time when the banner of the service was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.assetServices.banners.countNumberNumber of times the banner of the service is observed on the asset.
RiskIQDigitalFootprint.Asset.assetServices.banners.scanTypeStringScan type fetched from the banners details of the service observed on the asset.
RiskIQDigitalFootprint.Asset.assetServices.banners.bannerMetadataStringBanner metadata fetched from the banners details of the service observed on the asset.
RiskIQDigitalFootprint.Asset.assetServices.banners.recentBooleanIf the banner of the service observed on the asset is recent.
RiskIQDigitalFootprint.Asset.assetServices.scanMetadata.portNumberPort fetched from the scan metadata details of the service observed on the asset.
RiskIQDigitalFootprint.Asset.assetServices.scanMetadata.bannerMetadataStringBanner metadata fetched from the scan metadata details of the service observed on the asset.
RiskIQDigitalFootprint.Asset.assetServices.scanMetadata.startScanDateDate and Time when metadata scan of the service observed on the asset started.
RiskIQDigitalFootprint.Asset.assetServices.scanMetadata.endScanDateDate and Time when metadata scan of the service observed on the asset ended.
RiskIQDigitalFootprint.Asset.assetServices.currentBooleanIf the service observed on the asset is current.
RiskIQDigitalFootprint.Asset.assetCnames.valueStringCname of the asset.
RiskIQDigitalFootprint.Asset.assetCnames.firstSeenDateDate and Time when the Cname was first observed on the asset.
RiskIQDigitalFootprint.Asset.assetCnames.lastSeenDateDate and Time when the Cname was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.assetCnames.recentNumberIf the cname observed on the asset is recent.
RiskIQDigitalFootprint.Asset.assetCnames.currentNumberIf the cname observed on the asset is current.
RiskIQDigitalFootprint.Asset.assetResourceUrls.urlStringURL fetched from the Resource URL details of the asset.
RiskIQDigitalFootprint.Asset.assetResourceUrls.resources.md5StringMD5 of the resource fetched from the Resource URL details of the asset.
RiskIQDigitalFootprint.Asset.assetResourceUrls.resources.responseBodySizeNumberResponse body size of the resource fetched from the Resource URL details of the asset.
RiskIQDigitalFootprint.Asset.assetResourceUrls.resources.firstSeenDateDate and Time when the resource was first observed on the asset.
RiskIQDigitalFootprint.Asset.assetResourceUrls.resources.lastSeenDateDate and Time when the resource was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.assetResourceUrls.resources.countNumberThe number of times when the resource was observed on the asset.
RiskIQDigitalFootprint.Asset.assetResourceUrls.resources.firstSeenCrawlGuidStringCrawl GUID that was first observed for the resource observed on the asset.
RiskIQDigitalFootprint.Asset.assetResourceUrls.resources.firstSeenPageGuidStringPage GUID that was first observed for the resource observed on the asset.
RiskIQDigitalFootprint.Asset.assetResourceUrls.resources.firstSeenResourceGuidStringResource GUID that was first observed for the resource observed on the asset.
RiskIQDigitalFootprint.Asset.assetResourceUrls.resources.lastSeenCrawlGuidStringCrawl GUID that was first observed for the resource observed on the asset.
RiskIQDigitalFootprint.Asset.assetResourceUrls.resources.lastSeenPageGuidStringPage GUID that was first observed for the resource observed on the asset.
RiskIQDigitalFootprint.Asset.assetResourceUrls.resources.lastSeenResourceGuidStringResource GUID that was first observed for the resource observed on the asset.
RiskIQDigitalFootprint.Asset.assetResourceUrls.resources.responseBodyMinhashStringResponse body minimum hash for the resource observed on the asset.
RiskIQDigitalFootprint.Asset.assetResourceUrls.resources.contentTypeStringContent type of the resource observed on the asset.
RiskIQDigitalFootprint.Asset.assetResourceUrls.resources.sha256StringSHA256 of the resource observed on the asset.
RiskIQDigitalFootprint.Asset.assetResourceUrls.resources.sha384StringSHA384 of the resource observed on the asset.
RiskIQDigitalFootprint.Asset.assetResourceUrls.resources.sha512StringSHA512 of the resource observed on the asset.
RiskIQDigitalFootprint.Asset.assetResourceUrls.resources.urlStringURL of the resource fetched from the resources details of resource URLs observed on the asset.
RiskIQDigitalFootprint.Asset.assetResourceUrls.resources.cachedBooleanIf the resource observed on the asset is cached.
RiskIQDigitalFootprint.Asset.assetResourceUrls.resources.hostStringHost of the resource observed on the asset
RiskIQDigitalFootprint.Asset.assetResourceUrls.firstSeenDateDate and Time when the Resource URL was first observed.
RiskIQDigitalFootprint.Asset.assetResourceUrls.lastSeenDateDate and Time when the Resource URL was most recently observed.
RiskIQDigitalFootprint.Asset.assetResourceUrls.recentNumberIf the Resource URL observed on the asset is recent.
RiskIQDigitalFootprint.Asset.assetResourceUrls.currentNumberIf the Resource URL observed on the asset is current.
RiskIQDigitalFootprint.Asset.assetIpBlocks.ipBlockStringIP Block containing the IP Address.
RiskIQDigitalFootprint.Asset.assetIpBlocks.countNumberThe number of times that IP Block is observed for this asset.
RiskIQDigitalFootprint.Asset.assetIpBlocks.firstSeenDateDate and Time when the IP Block was first observed on the asset.
RiskIQDigitalFootprint.Asset.assetIpBlocks.lastSeenDateDate and Time when the IP Block was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.assetIpBlocks.recentBooleanIs IP Block observed on the asset recent.
RiskIQDigitalFootprint.Asset.assetIpBlocks.currentBooleanIs IP Block observed on the asset current.
RiskIQDigitalFootprint.Asset.assetNsRecord.valueBooleanIf this record is observed as an NS record on the asset.
RiskIQDigitalFootprint.Asset.assetNsRecord.firstSeenDateDate and Time when the NS record was first observed on the asset.
RiskIQDigitalFootprint.Asset.assetNsRecord.lastSeenDateDate and Time when the NS record was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.assetNsRecord.recentBooleanIf NS record value is current.
RiskIQDigitalFootprint.Asset.assetNsRecord.currentBooleanIf NS record value is recent.
RiskIQDigitalFootprint.Asset.assetMxRecord.valueBooleanIf this record is observed as an MX record on the asset.
RiskIQDigitalFootprint.Asset.assetMxRecord.firstSeenDateDate and Time when the MX record was first observed on the asset.
RiskIQDigitalFootprint.Asset.assetMxRecord.lastSeenDateDate and Time when the MX record was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.assetMxRecord.recentBooleanIf MX record value is current.
RiskIQDigitalFootprint.Asset.assetMxRecord.currentBooleanIf MX record value is recent.
RiskIQDigitalFootprint.Asset.assetWebserver.valueBoooleanIf a Web Server is observed on the asset.
RiskIQDigitalFootprint.Asset.assetWebserver.firstSeenDateDate and Time when the web server record was first observed on the asset.
RiskIQDigitalFootprint.Asset.assetWebserver.lastSeenDateDate and Time when the web server record was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.assetWebserver.recentBooleanIf the web server observed on the asset is recent.
RiskIQDigitalFootprint.Asset.assetWebserver.currentBooleanIf the web server observed on the asset is current.
RiskIQDigitalFootprint.Asset.assetLocation.value.countrycodeStringCountry code of the location observed on the asset.
RiskIQDigitalFootprint.Asset.assetLocation.value.countrynameStringCountry name of the location observed on the asset.
RiskIQDigitalFootprint.Asset.assetLocation.value.regionStringRegion of the location observed on the asset.
RiskIQDigitalFootprint.Asset.assetLocation.value.regionnameStringRegion name of the location observed on the asset.
RiskIQDigitalFootprint.Asset.assetLocation.value.postalcodeStringPostal code of the location observed on the asset.
RiskIQDigitalFootprint.Asset.assetLocation.value.latitudeNumberLatitude of the location observed on the asset.
RiskIQDigitalFootprint.Asset.assetLocation.value.longitudeNumberLongitude of the location observed on the asset.
RiskIQDigitalFootprint.Asset.assetLocation.value.metrocodeidNumberMetro code ID of the location observed on the asset.
RiskIQDigitalFootprint.Asset.assetLocation.firstSeenDateDate and Time when the location was first observed for the asset.
RiskIQDigitalFootprint.Asset.assetLocation.lastSeenDateDate and Time when the location was most recently observed for the asset.
RiskIQDigitalFootprint.Asset.assetAsnNumbers.valueNumberASN number observed on the asset.
RiskIQDigitalFootprint.Asset.assetAsnNumbers.firstSeenDateDate and Time when the ASN number was first observed on the asset.
RiskIQDigitalFootprint.Asset.assetAsnNumbers.lastSeenDateDate and Time when the ASN number was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.assetAsnNumbers.recentBooleanIf the ASN number observed on the asset is recent.
RiskIQDigitalFootprint.Asset.assetAsnNumbers.currentNumberIf the ASN number observed on the asset is current.
RiskIQDigitalFootprint.Asset.assetHostPairs.firstSeenDateDate and Time when the host pair was first observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostPairs.lastSeenDateDate and Time when the host pair was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostPairs.recentBooleanIf the host pair observed on the asset is recent.
RiskIQDigitalFootprint.Asset.assetHostPairs.childHostnameStringChild hostname of the host pair observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostPairs.parentHostnameStringParent hostname of the host pair observed on the asset.
RiskIQDigitalFootprint.Asset.assetHostPairs.currentBooleanIf the host pair observed on the asset is current.
RiskIQDigitalFootprint.Asset.discoveryRunIDNumberThe id of the discovery run in which the asset was discovered.
RiskIQDigitalFootprint.Asset.discoveryRunWorkspaceIDNumberID of the workspace in which the discovery took place.
RiskIQDigitalFootprint.Asset.discoveryRunRunTypeStringRun type of the discovery.
RiskIQDigitalFootprint.Asset.discoveryRunUserIDNumberID of the user who run the discovery.
RiskIQDigitalFootprint.Asset.discoveryRunRunDateDateRun Date of the discovery.
RiskIQDigitalFootprint.Asset.discoveryRunAssetTypeStringAsset type for which the discovery was run.
RiskIQDigitalFootprint.Asset.discoveryRunSearchCreatedAtDateDate and Time when the discovery run search was created.
RiskIQDigitalFootprint.Asset.discoveryRunSearchUpdatedAtDateDate and Time when the discovery run search was updated.
RiskIQDigitalFootprint.Asset.discoveryRunSearchStatusStringStatus of the discovery run search.
RiskIQDigitalFootprint.Asset.discoveryRunSearchAssetSearchIDNumberAsset search ID of the discovery run search.
RiskIQDigitalFootprint.Asset.discoveryRunSearchNameStringName of the discovery run search
RiskIQDigitalFootprint.Asset.discoveryRunSearchWorkspaceIDNumberWorkspace ID fetched from discovery run search details.
RiskIQDigitalFootprint.Asset.discoveryRunSearchSourceIDNumberSource ID of the discovery run search.
RiskIQDigitalFootprint.Asset.discoveryRunSearchQueryStringQuery applied to the discovery run search.
RiskIQDigitalFootprint.Asset.discoveryRunSearchMaxResultsNumberMax results fetched in the discovery run search.
RiskIQDigitalFootprint.Asset.discoveryRunSearchLastSearchDateDateDate and Time when the most recent discovery search was run.
RiskIQDigitalFootprint.Asset.discoveryRunSearchEnabledBooleanIf the discovery search is enabled.
RiskIQDigitalFootprint.Asset.discoveryRunSearchScheduledDateDate and Time when the discovery run search is scheduled.
RiskIQDigitalFootprint.Asset.discoveryRunSearchFrequencyNumberFrequency of the discovery run search.
RiskIQDigitalFootprint.Asset.discoveryRunSearchDiscoveredCountNumberCount of discovered assets in the discovery run search.
RiskIQDigitalFootprint.Asset.discoveryRunSearchAssetSearchStateStringAsset search state fetched from discovery run search details.
RiskIQDigitalFootprint.Asset.discoveryRunSearchAssetSearchTypeStringAsset search type fetched from discovery run search details.
RiskIQDigitalFootprint.Asset.discoveryRunSearchNotesStringNotes for the discovery run search.
RiskIQDigitalFootprint.Asset.discoveryRunSearchIdNumberID of the discovery run search.
RiskIQDigitalFootprint.Asset.discoveryRunFullNameStringFull name of the discovery run.
RiskIQDigitalFootprint.Asset.assetIpAddressStringIP address of the asset.
RiskIQDigitalFootprint.Asset.assetReputations.listNameStringReputation list name observed on the asset.
RiskIQDigitalFootprint.Asset.assetReputations.threatTypeStringReputation threat type observed on the asset
RiskIQDigitalFootprint.Asset.assetReputations.trustedBooleanIf the reputation can be trusted.
RiskIQDigitalFootprint.Asset.assetReputations.cidrStringReputation CIDR observed on the asset.
RiskIQDigitalFootprint.Asset.assetReputations.firstSeenDateDate and Time when the Reputation was first observed on the asset.
RiskIQDigitalFootprint.Asset.assetReputations.lastSeenDateDate and Time when the Reputation was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.assetReputations.listUpdatedAtDateDate and Time when the Reputation list observed on the asset was most recently updated.
RiskIQDigitalFootprint.Asset.assetReputations.recentBooleanIf the Reputation observed on the asset is recent.
RiskIQDigitalFootprint.Asset.assetReputations.currentBooleanIf the Reputation observed on the asset is current.
RiskIQDigitalFootprint.Asset.assetNetRanges.valueStringNet Range associated with the asset.
RiskIQDigitalFootprint.Asset.assetNetRanges.firstSeenDateDate and Time when the net range associated with the asset was first observed.
RiskIQDigitalFootprint.Asset.assetNetRanges.lastSeenDateDate and Time when the net range associated with the asset was most recently observed.
RiskIQDigitalFootprint.Asset.assetNetRanges.recentBooleanIf net range value observed on the asset is recent.
RiskIQDigitalFootprint.Asset.assetNetRanges.currentBooleanIf net range value observed on the asset is current.
RiskIQDigitalFootprint.Asset.assetHosts.valueStringHost observed on the asset.
RiskIQDigitalFootprint.Asset.assetHosts.firstSeenDateDate and Time when the host was first observed on the asset.
RiskIQDigitalFootprint.Asset.assetHosts.lastSeenDateDate and Time when the host was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.assetHosts.recentBooleanIf the host observed on the asset is recent.
RiskIQDigitalFootprint.Asset.assetHosts.currentBooleanIf the host observed on the asset is current.
RiskIQDigitalFootprint.Asset.assetAsns.asnIDNumberASN ID of the ASN observed on the asset.
RiskIQDigitalFootprint.Asset.assetAsns.descriptionStringDescription of the ASN observed on the asset.
RiskIQDigitalFootprint.Asset.assetAsns.registryStringRegistry of the ASN observed on the asset.
RiskIQDigitalFootprint.Asset.assetAsns.countryCodeStringCountry code of the ASN observed on the asset.
RiskIQDigitalFootprint.Asset.assetAsns.nameStringName of the ASN observed on the asset.
RiskIQDigitalFootprint.Asset.assetAsns.idNumberID of the ASN observed on the asset.
RiskIQDigitalFootprint.Asset.assetAsns.fullNameStringFull name of the ASN observed on the asset.
RiskIQDigitalFootprint.Asset.assetUrlStringURL of the page.
RiskIQDigitalFootprint.Asset.assetHttpMethodStringHTTP method used for the page.
RiskIQDigitalFootprint.Asset.assetServiceStringService of the page on which it is available.
RiskIQDigitalFootprint.Asset.assetSuccessful.valueBooleanIf the HTTP call made was successful for the page.
RiskIQDigitalFootprint.Asset.assetSuccessful.firstSeenDateDate and Time when the HTTP call was first observed to be successful for the page.
RiskIQDigitalFootprint.Asset.assetSuccessful.lastSeenDateDate and Time when the HTTP call was most recently observed to be successful for the page.
RiskIQDigitalFootprint.Asset.assetSuccessful.recentNumberIf the successful value for the page is recent.
RiskIQDigitalFootprint.Asset.assetSuccessful.currentNumberIf the successful value for the page is current.
RiskIQDigitalFootprint.Asset.assetHttpResponseCodes.valueNumberThe http response code returned by the page.
RiskIQDigitalFootprint.Asset.assetHttpResponseCodes.firstSeenDateDate and Time when the http response code returned by the page was first observed.
RiskIQDigitalFootprint.Asset.assetHttpResponseCodes.lastSeenDateDate and Time when the http response code returned by the page was most recently observed.
RiskIQDigitalFootprint.Asset.assetHttpResponseCodes.recentBooleanIf the http response code returned by the page is recent.
RiskIQDigitalFootprint.Asset.assetHttpResponseCodes.currentBooleanIf the http response code returned by the page is current.
RiskIQDigitalFootprint.Asset.assetHttpResponseMessages.valueStringThe http response message returned by the page.
RiskIQDigitalFootprint.Asset.assetHttpResponseMessages.firstSeenDateDate and Time when the http response message returned by the page was first observed.
RiskIQDigitalFootprint.Asset.assetHttpResponseMessages.lastSeenDateDate and Time when the http response message returned by the page was most recently observed.
RiskIQDigitalFootprint.Asset.assetHttpResponseMessages.recentBooleanIf the http response message returned by the page is recent.
RiskIQDigitalFootprint.Asset.assetHttpResponseMessages.currentBooleanIf the http response message returned by the page is current.
RiskIQDigitalFootprint.Asset.assetResponseTimes.valueNumberThe time taken by the page to respond.
RiskIQDigitalFootprint.Asset.assetResponseTimes.firstSeenDateDate and Time when the response time was first observed.
RiskIQDigitalFootprint.Asset.assetResponseTimes.lastSeenDateDate and Time when the response time was most recently observed.
RiskIQDigitalFootprint.Asset.assetResponseTimes.recentBooleanIf the response time value is recent.
RiskIQDigitalFootprint.Asset.assetResponseTimes.currentBooleanIf the response time value is current.
RiskIQDigitalFootprint.Asset.assetFrames.valueBooleanIf a frame is observed on the page.
RiskIQDigitalFootprint.Asset.assetFrames.firstSeenDateDate and Time when the frame was first observed on the page.
RiskIQDigitalFootprint.Asset.assetFrames.lastSeenDateDate and Time when the frame was most recently observed on the page.
RiskIQDigitalFootprint.Asset.assetFrames.recentBooleanIf the frame value is recent.
RiskIQDigitalFootprint.Asset.assetFrames.currentBooleanIf the frame value is current.
RiskIQDigitalFootprint.Asset.assetWindows.valueBooleanIf a window is observed on the page.
RiskIQDigitalFootprint.Asset.assetWindows.firstSeenDateDate and Time when the window was first observed on the page.
RiskIQDigitalFootprint.Asset.assetWindows.lastSeenDateDate and Time when the window was most recently observed on the page.
RiskIQDigitalFootprint.Asset.assetWindows.recentBooleanIf the window value is recent.
RiskIQDigitalFootprint.Asset.assetWindows.currentBooleanIf the window value is current.
RiskIQDigitalFootprint.Asset.assetContentTypes.valueStringContent type of the page.
RiskIQDigitalFootprint.Asset.assetContentTypes.firstSeenDateDate and Time when the content type of the page was first observed.
RiskIQDigitalFootprint.Asset.assetContentTypes.lastSeenDateDate and Time when the content type of the page was most recently observed.
RiskIQDigitalFootprint.Asset.assetContentTypes.recentBooleanIf the content type of the page is recent.
RiskIQDigitalFootprint.Asset.assetContentTypes.currentBooleanIf the content type of the page is current.
RiskIQDigitalFootprint.Asset.assetContentLengths.valueNumberContent length of the page.
RiskIQDigitalFootprint.Asset.assetContentLengths.firstSeenDateDate and Time when the content length of the page was first observed.
RiskIQDigitalFootprint.Asset.assetContentLengths.lastSeenDateDate and Time when the content length of the page was most recently observed.
RiskIQDigitalFootprint.Asset.assetContentLengths.recentBooleanIf the content length is recent.
RiskIQDigitalFootprint.Asset.assetContentLengths.currentBooleanIf the content length of the page is current.
RiskIQDigitalFootprint.Asset.assetWindowNames.valueStringWindow name of the page.
RiskIQDigitalFootprint.Asset.assetWindowNames.firstSeenDateDate and Time when the window name of the page was first observed.
RiskIQDigitalFootprint.Asset.assetWindowNames.lastSeenDateDate and Time when the window name of the page was most recently observed.
RiskIQDigitalFootprint.Asset.assetWindowNames.recentBooleanIf the window name value of the page is recent.
RiskIQDigitalFootprint.Asset.assetWindowNames.currentBooleanIf the window name value of the page is current.
RiskIQDigitalFootprint.Asset.assetCharsets.valueStringCharset of the page.
RiskIQDigitalFootprint.Asset.assetCharsets.firstSeenDateDate and Time when the charset of the page was first observed.
RiskIQDigitalFootprint.Asset.assetCharsets.lastSeenDateDate and Time when the charset of the page was most recently observed.
RiskIQDigitalFootprint.Asset.assetCharsets.recentBooleanIf the charset value of the page is recent.
RiskIQDigitalFootprint.Asset.assetCharsets.currentBooleanIf the charset value of the page is current.
RiskIQDigitalFootprint.Asset.assetTitles.valueStringTitle of the page.
RiskIQDigitalFootprint.Asset.assetTitles.firstSeenDateDate and Time when the title of the page was first observed.
RiskIQDigitalFootprint.Asset.assetTitles.lastSeenDateDate and Time when the title of the page was most recently observed.
RiskIQDigitalFootprint.Asset.assetTitles.recentBooleanIf the title of the page is recent.
RiskIQDigitalFootprint.Asset.assetTitles.currentBooleanIf the title of the page is current.
RiskIQDigitalFootprint.Asset.assetLanguages.valueStringLanguage of the page.
RiskIQDigitalFootprint.Asset.assetLanguages.firstSeenDateDate and Time when the language of the page was first observed.
RiskIQDigitalFootprint.Asset.assetLanguages.lastSeenDateDate and Time when the language of the page was most recently observed.
RiskIQDigitalFootprint.Asset.assetLanguages.recentBooleanIf the language of the page is recent.
RiskIQDigitalFootprint.Asset.assetLanguages.currentBooleanIf the language of the page is current.
RiskIQDigitalFootprint.Asset.assetResponseHeaders.headerNameStringHeader Name of the response header returned from the page.
RiskIQDigitalFootprint.Asset.assetResponseHeaders.headerValueStringHeader Value of the response header returned from the page.
RiskIQDigitalFootprint.Asset.assetResponseHeaders.firstSeenDateDate and Time when the response header returned from the page was first observed.
RiskIQDigitalFootprint.Asset.assetResponseHeaders.lastSeenDateDate and Time when the response header returned from the page was most recently observed.
RiskIQDigitalFootprint.Asset.assetResponseHeaders.recentBooleanIf the response header of the page is recent.
RiskIQDigitalFootprint.Asset.assetResponseHeaders.currentBooleanIf the response header of the page is current.
RiskIQDigitalFootprint.Asset.assetSecurityPolicies.policyNameStringSecurity policy violation identified on the page.
RiskIQDigitalFootprint.Asset.assetSecurityPolicies.isAffectedBooleanIf the page is affected by the security policy violation identified.
RiskIQDigitalFootprint.Asset.assetSecurityPolicies.descriptionStringDescription of the security policy violation identified on the page.
RiskIQDigitalFootprint.Asset.assetSecurityPolicies.firstSeenDateDate and Time when the security policy violation was first observed on the page.
RiskIQDigitalFootprint.Asset.assetSecurityPolicies.lastSeenDateDate and Time when the security policy violation was most recently observed on the page.
RiskIQDigitalFootprint.Asset.assetSecurityPolicies.recentBooleanIf the security policy violation of the page is recent.
RiskIQDigitalFootprint.Asset.assetSecurityPolicies.currentBooleanIf the security policy violation of the page is current.
RiskIQDigitalFootprint.Asset.assetResponseBodyHashSignatures.valueStringResponse body has signature of the asset.
RiskIQDigitalFootprint.Asset.assetResponseBodyHashSignatures.firstSeenDateDate and Time when the response body hash signature of the asset was first observed.
RiskIQDigitalFootprint.Asset.assetResponseBodyHashSignatures.lastSeenDateDate and Time when the response body hash signature of the asset was most recently observed.
RiskIQDigitalFootprint.Asset.assetResponseBodyHashSignatures.recentBooleanIf response body hash signature of the asset is recent.
RiskIQDigitalFootprint.Asset.assetResponseBodyHashSignatures.currentBooleanIf response body hash signature of the asset is current.
RiskIQDigitalFootprint.Asset.assetErrors.valueStringThe error encountered while crawling the page.
RiskIQDigitalFootprint.Asset.assetErrors.firstSeenDateDate and Time when the error was first encountered while crawling the page.
RiskIQDigitalFootprint.Asset.assetErrors.lastSeenDateDate and Time when the error was most recently encountered while crawling the page.
RiskIQDigitalFootprint.Asset.assetErrors.recentBooleanIf the error encountered while crawling the page is recent.
RiskIQDigitalFootprint.Asset.assetErrors.currentBooleanIf the error encountered while crawling the page is current.
RiskIQDigitalFootprint.Asset.assetCause.causepageguidStringCause Page GUID observed on the page.
RiskIQDigitalFootprint.Asset.assetCause.causeStringCause observed on the page.
RiskIQDigitalFootprint.Asset.assetCause.locationStringLocation of the page.
RiskIQDigitalFootprint.Asset.assetCause.possiblematchesNumberPosible matches of the page.
RiskIQDigitalFootprint.Asset.assetCause.loopdetectedBooleanIf the loop was detected due to the cause observed on the page.
RiskIQDigitalFootprint.Asset.assetCause.versionNumberVersion of the cause observed on the page.
RiskIQDigitalFootprint.Asset.assetReferrerStringReferrer of the page.
RiskIQDigitalFootprint.Asset.assetRedirectTypeStringRedirect type of the page.
RiskIQDigitalFootprint.Asset.assetFinalUrls.valueStringFinal URL of the page after following one or more redirects.
RiskIQDigitalFootprint.Asset.assetFinalUrls.firstSeenDateDate and Time when the final url of the page was first observed.
RiskIQDigitalFootprint.Asset.assetFinalUrls.lastSeenDateDate and Time when the final url of the page was most recently observed.
RiskIQDigitalFootprint.Asset.assetFinalUrls.recentBooleanIf final url of the page is recent.
RiskIQDigitalFootprint.Asset.assetFinalUrls.currentBooleanIf final url of the page is current.
RiskIQDigitalFootprint.Asset.assetFinalResponseCodes.valueNumberFinal response codes of the page after following one or more redirects.
RiskIQDigitalFootprint.Asset.assetFinalResponseCodes.firstSeenDateDate and Time when the final response code was first observed.
RiskIQDigitalFootprint.Asset.assetFinalResponseCodes.lastSeenDateDate and Time when the final response code was most recently observed.
RiskIQDigitalFootprint.Asset.assetFinalResponseCodes.recentBooleanIf the final response code is recent.
RiskIQDigitalFootprint.Asset.assetFinalResponseCodes.currentBooleanIf the final response code is current.
RiskIQDigitalFootprint.Asset.assetParkedPage.valueBooleanHas the page been identified as parked.
RiskIQDigitalFootprint.Asset.assetParkedPage.firstSeenDateDate and Time when the identified parked value of the page was first observed.
RiskIQDigitalFootprint.Asset.assetParkedPage.lastSeenDateDate and Time when the identified parked value of the page was most recently observed.
RiskIQDigitalFootprint.Asset.assetParkedPage.recentBooleanIf the parked page value is recent.
RiskIQDigitalFootprint.Asset.assetParkedPage.currentBooleanIf the parked page value is current.
RiskIQDigitalFootprint.Asset.assetGuids.pageGuidStringGUID of the page.
RiskIQDigitalFootprint.Asset.assetGuids.crawlStateGuidStringCrawl state GUID of the page.
RiskIQDigitalFootprint.Asset.assetGuids.loadDateDateDate and Time when the GUIDs of the page were loaded.
RiskIQDigitalFootprint.Asset.assetFinalIpAddresses.valueStringFinal IP Address of the page after following one or more redirects.
RiskIQDigitalFootprint.Asset.assetFinalIpAddresses.firstSeenDateDate and Time when the final IP Address of the page was first observed.
RiskIQDigitalFootprint.Asset.assetFinalIpAddresses.lastSeenDateDate and Time when the final IP Address of the page was most recently observed.
RiskIQDigitalFootprint.Asset.assetFinalIpAddresses.recentBooleanIf the final IP Address observed for the page is recent.
RiskIQDigitalFootprint.Asset.assetFinalIpAddresses.currentBooleanIf the final IP Address observed for the page is current.
RiskIQDigitalFootprint.Asset.assetFinalAsns.valueNumberFinal ASN of the page after following one or more redirects.
RiskIQDigitalFootprint.Asset.assetFinalAsns.firstSeenDateDate and Time when the final asn of the page was first observed.
RiskIQDigitalFootprint.Asset.assetFinalAsns.lastSeenDateDate and Time when the final asn of the page was most recently observed.
RiskIQDigitalFootprint.Asset.assetFinalAsns.recentBooleanIf the final asn observed for the page is recent.
RiskIQDigitalFootprint.Asset.assetFinalAsns.currentBooleanIf the final asn observed for the page is current.
RiskIQDigitalFootprint.Asset.assetFinalIpBlocks.ipBlockStringFinal IP Block of the page after following one or more redirects.
RiskIQDigitalFootprint.Asset.assetFinalIpBlocks.firstSeenDateDate and Time when the final IP Block of the page was first observed.
RiskIQDigitalFootprint.Asset.assetFinalIpBlocks.lastSeenDateDate and Time when the final IP Block of the page was most recently observed.
RiskIQDigitalFootprint.Asset.assetFinalIpBlocks.recentBooleanIf the final IP Block observed for the page is recent.
RiskIQDigitalFootprint.Asset.assetFinalIpBlocks.currentBooleanIf the final IP Block observed for the page is current.
RiskIQDigitalFootprint.Asset.assetIsRootUrlBooleanIf the URl is root URL.
RiskIQDigitalFootprint.Asset.assetAsNames.valueStringName of the ASN.
RiskIQDigitalFootprint.Asset.assetAsNames.firstSeenDateDate and Time when the ASN name was first observed.
RiskIQDigitalFootprint.Asset.assetAsNames.lastSeenDateDate and Time when the ASN name was most recently observed.
RiskIQDigitalFootprint.Asset.assetAsNames.recentBooleanIf the ASN name is recent.
RiskIQDigitalFootprint.Asset.assetAsNames.currentBooleanIf the ASN name is current.
RiskIQDigitalFootprint.Asset.assetOrgNames.valueStringOrganization name of the ASN.
RiskIQDigitalFootprint.Asset.assetOrgNames.firstSeenDateDate and Time when the organization name of the ASN was first observed.
RiskIQDigitalFootprint.Asset.assetOrgNames.lastSeenDateDate and Time when the organization name of the ASN was most recently observed.
RiskIQDigitalFootprint.Asset.assetOrgNames.recentBooleanIf the organization name is recent.
RiskIQDigitalFootprint.Asset.assetOrgNames.currentBooleanIf the organization name is current.
RiskIQDigitalFootprint.Asset.assetOrgIds.valueStringOrganization ID of the asset.
RiskIQDigitalFootprint.Asset.assetOrgIds.firstSeenDateDate and Time when the organization ID of the ASN was first observed.
RiskIQDigitalFootprint.Asset.assetOrgIds.lastSeenDateDate and Time when the organization ID of the ASN was most recently observed.
RiskIQDigitalFootprint.Asset.assetOrgIds.recentBooleanIf the organization id of the ASN is recent.
RiskIQDigitalFootprint.Asset.assetOrgIds.currentBooleanIf the organization id of the ASN is current.
RiskIQDigitalFootprint.Asset.assetCountries.valueStringCountry of the ASN.
RiskIQDigitalFootprint.Asset.assetCountries.firstSeenDateDate and Time when the Country of ASN was first observed.
RiskIQDigitalFootprint.Asset.assetCountries.lastSeenDateDate and Time when the Country of ASN was most recently observed.
RiskIQDigitalFootprint.Asset.assetCountries.recentBooleanIf the country of the ASN is recent.
RiskIQDigitalFootprint.Asset.assetCountries.currentBooleanIf the country of the ASN is current.
RiskIQDigitalFootprint.Asset.assetRegistries.valueStringRegistry of the ASN.
RiskIQDigitalFootprint.Asset.assetRegistries.firstSeenDateDate and Time when the registry of the ASN was first observed.
RiskIQDigitalFootprint.Asset.assetRegistries.lastSeenDateDate and Time when the registry of the ASN was most recently observed.
RiskIQDigitalFootprint.Asset.assetRegistries.recentBooleanIf the registry of ASN is recent.
RiskIQDigitalFootprint.Asset.assetRegistries.currentBooleanIf the registry of ASN is current.
RiskIQDigitalFootprint.Asset.assetAsnNumberNumberASN Number of the ASN.
RiskIQDigitalFootprint.Asset.assetAsn.asnIDNumberASN ID of the ASN.
RiskIQDigitalFootprint.Asset.assetAsn.descriptionStringDescription of the ASN.
RiskIQDigitalFootprint.Asset.assetAsn.registryStringRegistry of the ASN.
RiskIQDigitalFootprint.Asset.assetAsn.countryCodeStringCountry code of the ASN.
RiskIQDigitalFootprint.Asset.assetAsn.nameStringName of the ASN.
RiskIQDigitalFootprint.Asset.assetAsn.idNumberID of the ASN.
RiskIQDigitalFootprint.Asset.assetAsn.fullNameStringFull name of the ASN.
RiskIQDigitalFootprint.Asset.assetIpBlockStringIP Block of the asset.
RiskIQDigitalFootprint.Asset.assetBgpPrefixes.valueStringThe BGP prefix for the IP Block.
RiskIQDigitalFootprint.Asset.assetBgpPrefixes.firstSeenDateDate and Time when the BGP prefix for the IP Block was first observed.
RiskIQDigitalFootprint.Asset.assetBgpPrefixes.lastSeenDateDate and Time when the BGP prefix for the IP Block was most recently observed.
RiskIQDigitalFootprint.Asset.assetBgpPrefixes.recentBooleanIf the BGP prefix for the IP Block is recent.
RiskIQDigitalFootprint.Asset.assetBgpPrefixes.currentBooleanIf the BGP prefix for the IP Block is current.
RiskIQDigitalFootprint.Asset.assetNetNames.valueStringNet name observed on the asset.
RiskIQDigitalFootprint.Asset.assetNetNames.firstSeenDateDate and Time when the net name was first observed on the asset.
RiskIQDigitalFootprint.Asset.assetNetNames.lastSeenDateDate and Time when the net name was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.assetNetNames.recentBooleanIf the net name value observed on the asset is recent.
RiskIQDigitalFootprint.Asset.assetNetNames.currentBooleanIf the net name value observed on the asset is current.
RiskIQDigitalFootprint.Asset.assetStartIpStringStart IP Address of the IP Block.
RiskIQDigitalFootprint.Asset.assetEndIpStringEnd IP Address of the IP Block.
RiskIQDigitalFootprint.Asset.assetRegistrantContacts.valueStringRegistrant Contact of the asset.
RiskIQDigitalFootprint.Asset.assetRegistrantContacts.firstSeenDateDate and Time when the registrant contact was first observed.
RiskIQDigitalFootprint.Asset.assetRegistrantContacts.lastSeenDateDate and Time when the registrant contact was most recently observed.
RiskIQDigitalFootprint.Asset.assetRegistrantContacts.recentBooleanIf the registrant contact of the asset is recent.
RiskIQDigitalFootprint.Asset.assetRegistrantContacts.currentBooleanIf the registrant contact of the asset is current.
RiskIQDigitalFootprint.Asset.assetSha1StringSHA1 key of the SSL certificate.
RiskIQDigitalFootprint.Asset.assetSerialNumberStringSerial number of the SSL certificate.
RiskIQDigitalFootprint.Asset.assetKeySizeNumberKey size of the SSL certicate's key.
RiskIQDigitalFootprint.Asset.assetVersionNumberVersion of the SSL certificate.
RiskIQDigitalFootprint.Asset.assetCertificateAuthorityBooleanIf the authority of the SSL certificate is certified.
RiskIQDigitalFootprint.Asset.assetSelfSignedBooleanIf the SSL certificate observed on the asset is self signed.
RiskIQDigitalFootprint.Asset.assetSignatureAlgorithmStringSignature Algorithm of the SSL certificate.
RiskIQDigitalFootprint.Asset.assetSignatureAlgorithmOidStringSignature Algorithm OID of the SSL certificate.
RiskIQDigitalFootprint.Asset.assetNotBeforeDateDate and Time before which the SSL certificate is invalid.
RiskIQDigitalFootprint.Asset.assetNotAfterDateDate and Time after which the SSL certificate is invalid.
RiskIQDigitalFootprint.Asset.assetPublicKeyAlgorithmStringPublic Key Algorithm of the SSL certificate.
RiskIQDigitalFootprint.Asset.assetIdStringID of the SSL certificate.
RiskIQDigitalFootprint.Asset.issuerCountryStringCountry of the issuer of SSL certificate.
RiskIQDigitalFootprint.Asset.issuerUnitStringOrganization unit of the issuer of SSL certificate.
RiskIQDigitalFootprint.Asset.issuerOrganizationStringOrganization of the issuer of SSL certificate.
RiskIQDigitalFootprint.Asset.issuerCommonnameStringCommon Name of the issuer of SSL certificate.
RiskIQDigitalFootprint.Asset.issuerStateStringState of the issuer of SSL certificate.
RiskIQDigitalFootprint.Asset.issuerLocaleStringLocale of the issuer of SSL certificate.
RiskIQDigitalFootprint.Asset.subjectCommonnameStringCommon Name of the subject of SSL certificate.
RiskIQDigitalFootprint.Asset.subjectCountryStringCountry of the subject of SSL certificate.
RiskIQDigitalFootprint.Asset.subjectUnitStringOrganization unit of the subject of SSL certificate.
RiskIQDigitalFootprint.Asset.subjectOrganizationStringOrganization of the subject of SSL certificate.
RiskIQDigitalFootprint.Asset.subjectStateStringState of the subject of SSL certificate.
RiskIQDigitalFootprint.Asset.subjectLocaleStringLocale of the subject of SSL certificate.
RiskIQDigitalFootprint.Asset.issuerAlternativeNamesStringIssuer alternative names of the SSL certificate.
RiskIQDigitalFootprint.Asset.subjectAlternativeNamesStringSubject alternative names of the SSL certificate.
RiskIQDigitalFootprint.Asset.assetEmailStringEmail address associated with the contact asset.
RiskIQDigitalFootprint.Asset.assetNames.valueStringName associated with the contact asset.
RiskIQDigitalFootprint.Asset.assetNames.firstSeenDateDate and Time when the name associated with contact asset was first observed.
RiskIQDigitalFootprint.Asset.assetNames.lastSeenDateDate and Time when the name associated with contact asset was most recently observed.
RiskIQDigitalFootprint.Asset.assetNames.recentBooleanIf the name associated with contact asset is recent.
RiskIQDigitalFootprint.Asset.assetNames.currentBooleanIf the name associated with contact asset is current.
RiskIQDigitalFootprint.Asset.assetOrganizations.valueStringOrganization associated with the contact asset.
RiskIQDigitalFootprint.Asset.assetOrganizations.firstSeenDateDate and Time when the organization associated with contact asset was first observed.
RiskIQDigitalFootprint.Asset.assetOrganizations.lastSeenDateDate and Time when the organization associated with contact asset was most recently observed.
RiskIQDigitalFootprint.Asset.assetOrganizations.recentBooleanIf the organization associated with contact is recent.
RiskIQDigitalFootprint.Asset.assetOrganizations.currentBooleanIf the organization associated with contact is current.
RiskIQDigitalFootprint.Asset.history.addedStringAdded property value of the asset.
RiskIQDigitalFootprint.Asset.history.changedByStringName of the user who performed the change.
RiskIQDigitalFootprint.Asset.history.propertyStringProperty name that was updated.
RiskIQDigitalFootprint.Asset.history.updatedAtDateDate and Time when the change was most recently updated.
RiskIQDigitalFootprint.Asset.history.removedStringRemoved property value of the asset.
RiskIQDigitalFootprint.Asset.history.newValueStringValue of the property after the change was performed.
RiskIQDigitalFootprint.Asset.history.oldValueStringValue of the property before the change was performed.
RiskIQDigitalFootprint.Asset.history.reasonStringReason for performing this update.
RiskIQDigitalFootprint.Asset.data.hostPairs.firstSeenDateDate and Time when the host pair data was first observed on the asset.
RiskIQDigitalFootprint.Asset.data.hostPairs.lastSeenDateDate and Time when the host pair data was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.data.hostPairs.countNumberNumber of times the host pair data was observed on the asset.
RiskIQDigitalFootprint.Asset.data.hostPairs.idStringID of the host pair data observed on the asset.
RiskIQDigitalFootprint.Asset.data.hostPairs.childHostnameStringChild hostname of the host pair data observed on the asset.
RiskIQDigitalFootprint.Asset.data.hostPairs.parentHostnameStringParent hostname of the host pair data observed on the asset.
RiskIQDigitalFootprint.Asset.data.hostPairs.causeStringCause of the host pair data observed on the asset.
RiskIQDigitalFootprint.Asset.data.hostPairs.childCountNumberNumber of times the child hostname for host pair data was observed on the asset.
RiskIQDigitalFootprint.Asset.data.hostPairs.parentCountNumberNumber of times the parent hostname for host pair data was observed on the asset.
RiskIQDigitalFootprint.Asset.data.hostPairs.childScoreNumberScore of the child hostname for host pair data observed on the asset.
RiskIQDigitalFootprint.Asset.data.hostPairs.parentScoreNumberScore of the parent hostname for host pair data observed on the asset.
RiskIQDigitalFootprint.Asset.data.hostPairs.pairScoreNumberScore of the host pair data observed on the asset.
RiskIQDigitalFootprint.Asset.data.attributes.firstSeenDateDate and Time when the attribute data was first observed on the asset.
RiskIQDigitalFootprint.Asset.data.attributes.lastSeenDateDate and Time when the attribute data was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.data.attributes.countNumberNumber of times the attribute data was observed on the asset.
RiskIQDigitalFootprint.Asset.data.attributes.idStringID of the attribute data observed on the asset.
RiskIQDigitalFootprint.Asset.data.attributes.hostnameStringHostname of the attribute data observed on the asset.
RiskIQDigitalFootprint.Asset.data.attributes.domainStringDomain of the attribute data observed on the asset.
RiskIQDigitalFootprint.Asset.data.attributes.attributeValueStringAttribute value of the attribute data observed on the asset.
RiskIQDigitalFootprint.Asset.data.attributes.attributeTypeStringAttribute type of the attribute data observed on the asset.
RiskIQDigitalFootprint.Asset.data.attributes.addressStringAddress of the attribute data observed on the asset.
RiskIQDigitalFootprint.Asset.data.attributes.asnNumberASN number of the attribute data observed on the asset.
RiskIQDigitalFootprint.Asset.data.attributes.bgpPrefixStringBGP Prefix of the attribute data observed on the asset.
RiskIQDigitalFootprint.Asset.data.webComponents.firstSeenDateDate and Time when the web component data was first observed on the asset.
RiskIQDigitalFootprint.Asset.data.webComponents.lastSeenDateDate and Time when the web component data was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.data.webComponents.countNumberNumber of times the web component data was observed on the asset.
RiskIQDigitalFootprint.Asset.data.webComponents.idStringID of the web component data observed on the asset.
RiskIQDigitalFootprint.Asset.data.webComponents.hostnameStringHostname of the web component data observed on the asset.
RiskIQDigitalFootprint.Asset.data.webComponents.domainStringDomain of the web component data observed on the asset.
RiskIQDigitalFootprint.Asset.data.webComponents.webComponentNameStringName of the web component data observed on the asset.
RiskIQDigitalFootprint.Asset.data.webComponents.webComponentCategoryStringCategory of the web component data observed on the asset.
RiskIQDigitalFootprint.Asset.data.webComponents.ports.firstSeenDateDate and Time when the ports of web component data was first observed on the asset.
RiskIQDigitalFootprint.Asset.data.webComponents.ports.lastSeenDateDate and Time when the ports of web component data was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.data.webComponents.ports.countNumberNumber of times the port of web component data was observed on the asset.
RiskIQDigitalFootprint.Asset.data.webComponents.ports.portNumberNumberPort number of web component data observed on the asset.
RiskIQDigitalFootprint.Asset.data.webComponents.webComponentVersionStringWeb component version of web component data observed on the asset.
RiskIQDigitalFootprint.Asset.data.webComponents.addressStringAddress of web component data observed on the asset.
RiskIQDigitalFootprint.Asset.data.webComponents.asnNumberASN number of web component data observed on the asset.
RiskIQDigitalFootprint.Asset.data.webComponents.bgpPrefixStringBGP prefix of web component data observed on the asset.
RiskIQDigitalFootprint.Asset.data.webComponents.cves.nameStringCVE name of web component data observed on the asset.
RiskIQDigitalFootprint.Asset.data.webComponents.cves.cweIDStringCWE ID of web component data observed on the asset.
RiskIQDigitalFootprint.Asset.data.webComponents.cves.cvssScoreNumberCVSS score of web component data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.firstSeenDateDate and Time when when the SSL certificate data was first observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.lastSeenDateDate and Time when when the SSL certificate data was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.countNumberNumber of times the SSL certificate data was observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.idStringID of the SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.sha1StringSHA1 of the SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.versionNumberVersion of the SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.serialNumberStringSerial number of the SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.signatureAlgorithmStringSignature algorithm of the SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.signatureAlgorithmOidStringSignature algorithm OID of the SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.issuer.countryStringCountry of the issuer of SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.issuer.unitStringOrganization Unit of the issuer of SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.issuer.organizationStringOrganization of the issuer of SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.issuer.commonnameStringCommon Name of the issuer of SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.issuer.stateStringState of the issuer of SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.issuer.localeStringLocale of the issuer of SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.subject.commonnameStringCommon Name of the subject of SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.subject.countryStringCountry of the subject of SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.subject.unitStringOrganization Unit of the subject of SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.subject.organizationStringOrganization of the subject of SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.subject.stateStringState of the subject of SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.subject.localeStringLocale of the subject of SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.notBeforeDateDate and Time before which the SSL certificate data observed on the asset is invalid.
RiskIQDigitalFootprint.Asset.data.sslCerts.notAfterDateDate and Time after which the SSL certificate data observed on the asset is invalid.
RiskIQDigitalFootprint.Asset.data.sslCerts.subjectAlternativeNamesStringSubject alternative names of the SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.issuerAlternativeNamesStringIssuer alternative names of the SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.publicKeyAlgorithmStringPublic Key Algorithm of the SSL certificate data observed on the asset.
RiskIQDigitalFootprint.Asset.data.sslCerts.certificateAuthorityBooleanIf the authority of the SSL certificate data observed on the asset is certified.
RiskIQDigitalFootprint.Asset.data.sslCerts.selfSignedBooleanIf the SSL certificate data observed on the asset is self signed.
RiskIQDigitalFootprint.Asset.data.cookies.firstSeenDateDate and Time when the cookie data was first observed on the asset.
RiskIQDigitalFootprint.Asset.data.cookies.lastSeenDateDate and Time when the cookie data was most recently observed on the asset.
RiskIQDigitalFootprint.Asset.data.cookies.countNumberNumber of times the cookie data was observed on the asset.
RiskIQDigitalFootprint.Asset.data.cookies.idStringID of the cookie data observed on the asset.
RiskIQDigitalFootprint.Asset.data.cookies.hostnameStringHost name of the cookie data observed on the asset.
RiskIQDigitalFootprint.Asset.data.cookies.domainStringDomain of the cookie data observed on the asset.
RiskIQDigitalFootprint.Asset.data.cookies.cookieDomainStringCookie Domain of the cookie data observed on the asset.
RiskIQDigitalFootprint.Asset.data.cookies.cookieNameStringCookie name of the cookie data observed on the asset.
RiskIQDigitalFootprint.Asset.data.cookies.addressStringAddress of the cookie data observed on the asset.
RiskIQDigitalFootprint.Asset.data.cookies.asnNumberASN number of the cookie data observed on the asset.
RiskIQDigitalFootprint.Asset.data.cookies.bgpPrefixStringBGP prefix of the cookie data observed on the asset.

Command Example

!df-get-asset name="dummy.com" type="Domain" global="true"

Context Example

{
"DBotScore": {
"Indicator": "dummy.com",
"Score": 0,
"Type": "domain",
"Vendor": "RiskIQ Digital Footprint"
},
"Domain": {
"Admin": {
"Country": "",
"Email": "admin@dummy.com",
"Name": "Domain Manager",
"Phone": "12 3456789101"
},
"Name": "dummy.com",
"NameServers": "dummy.nameserver.com",
"Registrant": {
"Country": "",
"Email": "domains@dummy.com",
"Name": "RiskIQ, Inc.",
"Phone": "1 2345678901"
},
"WHOIS": {
"Admin": {
"Country": "",
"Email": "admin@dummy.com",
"Name": "Domain Manager",
"Phone": "12 3456789101"
},
"NameServers": "dummy.nameserver.com",
"Registrant": {
"Country": "",
"Email": "domains@dummy.com",
"Name": "RiskIQ, Inc.",
"Phone": "1 2345678901"
}
}
},
"RiskIQDigitalFootprint": {
"Asset": {
"assetAdminContacts": [
{
"current": true,
"firstSeen": 1558844749884,
"lastSeen": 1592699566724,
"recent": true,
"value": "admin@dummy.com"
}
],
"assetAlexaRank": "Not in Alexa",
"assetCount": 1063,
"assetDetailedFromWhoisAt": 1592699566724,
"assetDomain": "dummy.com",
"assetFirstSeen": 1558769518000,
"assetLastSeen": 1593124040000,
"assetNameServers": [
{
"current": true,
"firstSeen": 1558769518000,
"lastSeen": 1593124040000,
"recent": true,
"value": "dummy.nameserver.com"
},
{
"current": true,
"firstSeen": 1558769518000,
"lastSeen": 1593124040000,
"recent": true,
"value": "dummy1.nameserver.com"
}
],
"assetParkedDomain": [
{
"firstSeen": 1558836583687,
"lastSeen": 1558836583687,
"value": false
}
],
"assetRegistrantContacts": [
{
"current": true,
"firstSeen": 1558844749884,
"lastSeen": 1592699566724,
"recent": true,
"value": "domains@dummy.com"
}
],
"assetRegistrantOrgs": [
{
"current": true,
"firstSeen": 1558844749884,
"lastSeen": 1592699566724,
"recent": true,
"value": "RiskIQ, Inc."
}
],
"assetRegistrarCreatedAt": [
{
"current": true,
"firstSeen": 1558844749884,
"lastSeen": 1592699566724,
"recent": true,
"value": 1494374400000
}
],
"assetRegistrarExpiresAt": [
{
"current": true,
"firstSeen": 1589819603070,
"lastSeen": 1592699566724,
"recent": true,
"value": 1620604800000
},
{
"firstSeen": 1558844749884,
"lastSeen": 1589819603070,
"value": 1589068800000
}
],
"assetSoaRecords": [
{
"current": true,
"email": "dummyadm@dummy.com",
"firstSeen": 1558769518000,
"lastSeen": 1593124040000,
"nameServer": "dummy.nameserver.com",
"recent": true,
"serialNumber": 1587126286
}
],
"assetTechnicalContacts": [
{
"current": true,
"firstSeen": 1558844749884,
"lastSeen": 1592699566724,
"recent": true,
"value": "technical@dummy.com"
}
],
"assetWhoisId": 6668186720435795000,
"assetWhoisServers": [
{
"current": true,
"firstSeen": 1558844749884,
"lastSeen": 1592699566724,
"recent": true,
"value": "whois.dummy.com"
}
],
"description": "dummy.com",
"firstSeen": 1558769518000,
"label": "dummy.com",
"lastSeen": 1593362239046,
"name": "dummy.com",
"type": "DOMAIN",
"uuid": "78c63cee-18bb-d342-f00d-81bdbcf53be8",
"whoisAdminEmail": "admin@dummy.com",
"whoisAdminId": 0,
"whoisAdminOrganization": "Domain Manager",
"whoisAdminPhone": "12 3456789101",
"whoisAdminWhoisContactID": 0,
"whoisAuditCreatedAt": 1589819603039,
"whoisAuditUpdatedAt": 1589819603039,
"whoisCompositeParseCode": 7619,
"whoisContactEmails": "domains@dummy.com, admin@dummy.com, technical@dummy.com, dummyadm@dummy.com",
"whoisContactOrganizations": "RiskIQ, Inc., Domain Manager, Technical Manager, Domain Parking Admin",
"whoisContacts": [
{
"email": "domains@dummy.com",
"id": 0,
"organization": "RiskIQ, Inc.",
"phone": "1 2345678901",
"whoisContactID": 0
},
{
"email": "admin@dummy.com",
"id": 0,
"organization": "Domain Manager",
"phone": "12 3456789101",
"whoisContactID": 0
},
{
"email": "technical@dummy.com",
"id": 0,
"organization": "Technical Manager",
"phone": "12 3456789101",
"whoisContactID": 0
},
{
"email": "dummyadm@dummy.com",
"id": 0,
"organization": "Domain Parking Admin",
"phone": "354 5782030",
"whoisContactID": 0
}
],
"whoisCreatedAt": 1589819603070,
"whoisDomain": "dummy.com",
"whoisDomainAvailable": false,
"whoisDomainMd5": "63dfc67f70ed3fb8f2fa1b26fa52cadc",
"whoisDomainUnicode": "dummy.com",
"whoisExpired": false,
"whoisID": 6668186720435795000,
"whoisId": 6668186720435795000,
"whoisNameservers": "dummy.nameserver.com",
"whoisNoRecord": false,
"whoisRegistrantEmail": "domains@dummy.com",
"whoisRegistrantId": 0,
"whoisRegistrantOrganization": "RiskIQ, Inc.",
"whoisRegistrantPhone": "1 2345678901",
"whoisRegistrantWhoisContactID": 0,
"whoisRegistrarCreatedAt": 1494374400000,
"whoisRegistrarExpiresAt": 1620604800000,
"whoisRegistrarParseCode": 0,
"whoisRegistryParseCode": 7619,
"whoisServer": "whois.dummy.com",
"whoisStatus": "ACTIVE",
"whoisTechnicalEmail": "technical@dummy.com",
"whoisTechnicalId": 0,
"whoisTechnicalOrganization": "Technical Manager",
"whoisTechnicalPhone": "12 3456789101",
"whoisTechnicalWhoisContactID": 0,
"whoisTld": "is",
"whoisUpdatedAt": 1592699566724
}
}
}

Human Readable Output

ASSET DETAILS

Basic Details

NameTypeUUIDFirst Seen (GMT)Last Seen (GMT)
dummy.comDOMAIN78c63cee-18bb-d342-f00d-81bdbcf53be82019-05-25 07:31:582020-06-28 16:37:19

Domain Details

Domain NameAlexa Rank
dummy.comNot in Alexa

Name Servers

NameFirst Seen (GMT)Last Seen (GMT)RecentCurrent
dummy.nameserver.com2019-05-25 07:31:582020-06-25 22:27:20truetrue
dummy1.nameserver.com2019-05-25 07:31:582020-06-25 22:27:20truetrue

WHOIS

Whois ServerEmailOrganizationPhoneName Servers
whois.dummy.comRegistrant: domains@dummy.com
Admin: admin@dummy.com
Technical: technical@dummy.com
Registrant: RiskIQ, Inc.
Admin: Domain Manager
Technical: Technical Manager
Registrant: 1 2345678901
Admin: 12 3456789101
Technical: 12 3456789101
dummy.nameserver.com

df-add-assets


Add one or more assets to Global Inventory with a provided set of properties to apply to all assets.

Base Command

df-add-assets

Input

Argument NameDescriptionRequired
nameName of the asset to be added. This argument supports a single value only.Optional
typeAsset type. Possible values: Domain, Host, IP Address, IP Block, ASN, Page, SSL Cert, Contact. This argument supports a single value only.Optional
stateSet the asset state. Possible values: Candidate, Approved Inventory, Requires Investigation, Dependencies, Monitor Only. This argument supports a single value only.Optional
prioritySet the asset Priority. Possible values: High, Medium, Low, None. The default value for this argument from RiskIQ platform is None. This argument supports a single value only.Optional
confirmA boolean value to indicate if the asset state should be CONFIRMED into inventory (confirm: true) or as a CANDIDATE asset in inventory (confirm: false or not specified). This argument supports a single value only.Optional
target_asset_typesA list of target asset types to also add to inventory, along with any supplied properties, that are connected to the asset identifiers (e.g. an asset identifier for a PAGE can cascade the properties to all known IPs for that PAGE). Provide comma(,) separated values to add multiple target asset types.Optional
fail_on_errorIf true then the request will fail if an invalid update is detected. If false then any invalid updates will be skipped but others will continue. The default value for this argument from RiskIQ platform is true. This argument supports a single value only.Optional
asset_jsonA raw JSON payload or a file entry ID that consists of a JSON payload which has the set of properties for the asset(s) to be added to inventory.Optional
brandName or numeric id of a brand to be applied to the asset. Provide comma(,) separated values to add multiple brand values.Optional
organizationName or numeric id of an organization to be applied to the asset. Provide comma(,) separated values to add multiple organization values.Optional
tagName or numeric id of a tag to be applied to the asset. Provide comma(,) separated values to add multiple tags.Optional
enterpriseDesignated as an enterprise asset. Possible values: true, false. This argument supports a single value only.Optional

Context Output

PathTypeDescription
RiskIQDigitalFootprint.Task.uuidStringUnique Identifier to check the status of the added asset using Get Task Status request.
RiskIQDigitalFootprint.Task.stateStringThe state of the task for adding the asset according to the last fetch.
RiskIQDigitalFootprint.Task.reasonStringThe reason mentioned in the task for adding the asset according to the last fetch.
RiskIQDigitalFootprint.Task.estimatedNumberNumber of estimated asset(s) that should be added.
RiskIQDigitalFootprint.Task.totalUpdatesNumberNumber of total assets that have been added.

Command Example

!df-add-assets name="testdomain.com" type="Domain"

Context Example

{
"RiskIQDigitalFootprint": {
"Task": {
"estimated": 1,
"state": "COMPLETE",
"totalUpdates": 1,
"uuid": "fbe5e0a7-ec92-4a8e-bd3c-4b9c4b8cbd78"
}
}
}

Human Readable Output

The requested asset(s) have been successfully added.

df-update-assets


Update one or more assets in Global Inventory with provided set of properties.

Base Command

df-update-assets

Input

Argument NameDescriptionRequired
nameName of the asset to be updated. This argument supports a single value only.Optional
typeThe type of the asset to be updated. Possible values: Domain, Host, IP Address, IP Block, ASN, Page, SSL Cert, Contact. This argument supports a single value only.Optional
stateSet the asset state. Possible values: Candidate, Approved Inventory, Requires Investigation, Dependencies, Monitor Only. This argument supports a single value only.Optional
prioritySet the asset priority. Possible values: High, Medium, Low, None. The default value for this argument from RiskIQ platform is None. This argument supports a single value only.Optional
removed_stateRemove an asset from inventory. Possible values: Dismissed. This argument supports a single value only.Optional
target_asset_typesAn array of related asset types which will also be updated. (e.g. an asset identifier for a PAGE can cascade the properties to all known IPs for that PAGE).Optional
fail_on_errorIf true then the request will fail if an invalid update is detected. If false then any invalid updates will be skipped but others will continue. The default value for this argument from RiskIQ platform is true. This argument supports a single value only.Optional
asset_jsonA raw JSON payload or a file entry ID that consists of a JSON payload which has the set of properties for the asset(s) to be updated in inventory.Optional
brandName or numeric id of a brand to be applied to the asset. Provide comma(,) separated values to update multiple brand values.Optional
organizationName or numeric id of an organization to be applied to the asset. Provide comma(,) separated values to update multiple organization values.Optional
tagName or numeric id of a tag to be applied to the asset. Provide comma(,) separated values to update multiple tags.Optional
actionThe action to be performed for updating the given properties. The possible values are: Update, Add, Remove with Update being the default. The value for this argument will be considered as action for all the properties passed by the user. This argument supports a single value only.Optional
enterpriseDesignated as an enterprise asset. Possible values: true, false. This argument supports a single value only.Optional

Context Output

PathTypeDescription
RiskIQDigitalFootprint.Task.uuidStringUnique Identifier to check the status of the updating asset using Get Task Status request.
RiskIQDigitalFootprint.Task.stateStringThe state of the task for updating the asset according to the last fetch.
RiskIQDigitalFootprint.Task.reasonStringThe reason mentioned in the task for updating the asset according to the last fetch.
RiskIQDigitalFootprint.Task.estimatedNumberNumber of estimated asset(s) that should be updated.
RiskIQDigitalFootprint.Task.totalUpdatesNumberNumber of total asset(s) that have been updated.

Command Example

!df-update-assets name="dummy.com" type="Domain" organization="RiskIQ" action="Add"

Context Example

{
"RiskIQDigitalFootprint": {
"Task": {
"estimated": 1,
"state": "COMPLETE",
"totalUpdates": 1,
"uuid": "62e41139-5f0b-4583-a2b9-2b18f80b4840"
}
}
}

Human Readable Output

The requested asset(s) have been successfully updated.