Integration combines Farsight Security DNSDB with Cortex XSOAR to automate contextualization and correlation of DNS-related artifacts used in cybercrimes
The new move will provide automated, actionable DNS intelligence for cyber investigations
San Francisco, NFAPost: Farsight Security®, Inc., the leader in DNS Intelligence, today announced that Farsight DNSDB®, the world’s largest historical DNS intelligence database, is now integrated with Palo Alto Networks Cortex XSOAR, the industry’s first extended security orchestration, automation and response platform that empowers security teams by simplifying and harmonizing security operations across their enterprise.
Through this integration, Farsight DNSDB and Cortex XSOAR enable security analysts to uncover and gain context for all connected DNS-related digital artifacts, from domain names and IP addresses to nameservers and MX records, in seconds.
Farsight Security is offering a free content pack entitled “DNSDB” in the Cortex XSOAR integrations marketplace. The DNSDB content pack contains three playbooks that integrate into existing automation processes to automatically contextualize and correlate all DNS-related assets.
Security practitioners
For example, while responding to a reported malicious domain, users can uncover the associated domains and IP addresses to reveal the attacker’s infrastructure which may have already been used or may be used in the future for an attack. Using the playbooks, security practitioners can retrieve: All hostnames seen for a given IP around the time of observation.
All IPs seen for a given hostname around the time of observation.A limited number of other hostnames seen on the same IPs as the target hostname.
Cortex XSOAR vice president of product strategy at Palo Alto Networks Rishi Bhargava said a broad and open ecosystem is vital to the successful adoption of any XSOAR platform.
“We are proud to welcome Farsight Security to the Cortex XSOAR ecosystem, which has partner-owned integrations that enable customers to streamline security processes, connect disparate security tools and technologies, and maintain the right balance of machine-powered security automation and human intervention,” said Cortex XSOAR vice president of product strategy at Palo Alto Networks Rishi Bhargava.
IP address
Commenting on the development, Farsight Security CEO Dr. Paul Vixie said every online transaction, good or bad, begins with a DNS lookup.
“Yet domain names and IP addresses can be used and discarded by criminals in minutes or even seconds. Farsight DNSDB enables users to map malicious infrastructure – even when the website has disappeared or the IP address or nameserver for the suspicious DNS asset has changed. Farsight Security is proud to be part of the Cortex XSOAR marketplace and these playbooks will measurably improve the speed and accuracy of our joint customer investigations,” said Farsight Security CEO Dr. Paul Vixie.
Cortex XSOAR is an extended security orchestration, automation and response platform that unifies case management, automation, real-time collaboration and threat intel management to transform every stage of the incident lifecycle.
Teams can manage alerts across all sources, standardize processes with playbooks, take action on threat intel and automate response for any security use case — resulting in significantly faster responses that require less manual review.
Farsight Security, Inc. is the world’s largest provider of historical and real-time passive DNS data. We enable security teams to qualify, enrich and correlate all sources of threat data and ultimately save time when it is most critical – during an attack or investigation.
The company’s solutions provide enterprise, government and security industry personnel and platforms with unmatched global visibility, context and response. Farsight Security is headquartered in San Mateo, California, USA.
