Farsight DNSDB and Cortex XSOAR help gain context for all connected DNS-related digital artifacts
Farsight Security announced that Farsight DNSDB, a DNS intelligence database, is now integrated with Palo Alto Networks Cortex XSOAR, an extended security orchestration, automation and response platform that empowers security teams by simplifying and harmonizing security operations across their enterprise.
Through this integration, Farsight DNSDB and Cortex XSOAR enable security analysts to uncover and gain context for all connected DNS-related digital artifacts, from domain names and IP addresses to nameservers and MX records, in seconds.
Farsight Security is offering a free content pack entitled “DNSDB” in the Cortex XSOAR integrations marketplace. The DNSDB content pack contains three playbooks that integrate into existing automation processes to automatically contextualize and correlate all DNS-related assets.
For example, while responding to a reported malicious domain, users can uncover the associated domains and IP addresses to reveal the attacker’s infrastructure which may have already been used or may be used in the future for an attack.
Using the playbooks, security practitioners can retrieve:
- All hostnames seen for a given IP around the time of observation.
- All IPs seen for a given hostname around the time of observation.
- A limited number of other hostnames seen on the same IPs as the target hostname.
“A broad and open ecosystem is vital to the successful adoption of any XSOAR platform,” said Rishi Bhargava, vice president of product strategy, Cortex XSOAR at Palo Alto Networks.
“We are proud to welcome Farsight Security to the Cortex XSOAR ecosystem, which has partner-owned integrations that enable customers to streamline security processes, connect disparate security tools and technologies, and maintain the right balance of machine-powered security automation and human intervention.”
“Every online transaction, good or bad, begins with a DNS lookup. Yet domain names and IP addresses can be used and discarded by criminals in minutes or even seconds. Farsight DNSDB enables users to map malicious infrastructure – even when the website has disappeared or the IP address or nameserver for the suspicious DNS asset has changed.
“Farsight Security is proud to be part of the Cortex XSOAR marketplace and these playbooks will measurably improve the speed and accuracy of our joint customer investigations,” said Farsight Security CEO Dr. Paul Vixie.
Cortex XSOAR is an extended security orchestration, automation and response platform that unifies case management, automation, real-time collaboration and threat intel management to transform every stage of the incident lifecycle.
Teams can manage alerts across all sources, standardize processes with playbooks, take action on threat intel and automate response for any security use case — resulting in significantly faster responses that require less manual review.