Get DNS Signature
Table of Contents
Expand all | Collapse all
-
- Get Session Details
- Get Sample Analysis
- Get Tags
- Get Tag Details
- Get Threat Indicator Feed
- Get Custom Threat Indicator Feed
- Get Threat Intelligence Card Summary
- Export List
- Get Anti-spyware, Vulnerability, and File-Format Signature
- Get Antivirus Signature
- Get DNS Signature
- Get Geolocation
- Get Anti-spyware, Vulnerability, and File-Format Release Info
Get DNS Signature
Use this resource to get DNS and RTDNS signature info
based on the specified signature ID.
Resource
https://autofocus.paloaltonetworks.com/api/intel/v1/threatvault/dns/signature/{DNS_RTDNS_signature_id}
Request Parameters
The following table describes the parameters
used with this endpoint.
Parameters | Description | Type | Example or Possible Values |
|---|---|---|---|
| apiKey | (Required) API key tied to your license.
All users attached to a license share a single API key. | string | Example (obfuscated): d32108a5-XXX-XXXX-XXXX-c04bda5b8450 |
| {DNS_signature_id} | (Required) The identification number of a
DNS/RTDNS signature. | string | The threat ID for DNS/RTDNS signature. Example:
|
JSON Sample
Request
Include
the API key and DNS signature ID number in the resource URL.
curl -X GET "https://autofocus.paloaltonetworks.com/api/intel/v1/threatvault/dns/signature/109000001?api_key=apiKey" -H "accept: application/json"
Response
The
response contains details about the DNS signature.
{ "domainName": "wwiyudruofdsu439.com", "signatureId": 109000001, "signatureName": "Real-Time DNS Detection: DGA", "category": "rtdns", "createTime": "2018-07-23 23:58:42(UTC)", "active": true, "release": { "wildfire": { "latestReleaseVersion": n/a, "latestReleaseTime": n/a, "firstReleaseVersion": n/a, "firstReleaseTime": n/a }, "antivirus": { "latestReleaseVersion": n/a, "latestReleaseTime": n/a, "firstReleaseVersion": n/a, "firstReleaseTime": n/a } } }