cs_hunt_domain 
Note: Access to this operator is provided on a limited-availability basis. Contact Anomali Customer Support for more information.
Use the cs_hunt_domain to get a list of device AIDs on which the specified domain was matched.
The device identifiers are returned in the AID output field. You can use this field with the cs_hunt_domain, cs_hunt_file, cs_hunt_ip, and cs_query_device operators to perform analysis and threat hunting.
Syntax
| cs_hunt_domain cs_domain_name=<domain_name> [cs_limit=<max_results>]
cs_domain_name=<domain_name>
|
Specify a domain name enclosed in double quotes. |
cs_limit=<max_results>
|
Optional. Specify the maximum number of results to return. Default value: Maximum value: |
Examples
Example 1: Retrieve the list of device AIDs matched on the specified domain.
| cs_hunt_domain cs_domain_name="google.com"
Example 2: Retrieve the list of device AIDs matched on the specified domain. Limit the returned results to 500.
| cs_hunt_domain cs_domain_name="malicious-domain.com" cs_limit=500
Example 3: Retrieve device AIDs on which the specified domain was matched and then get their device details.
| cs_hunt_domain cs_domain_name="google.com" | cs_get_system_info cs_id_list=AID