Feedback:

whois

Use the whois operator to enrich an IP address or field containing an IP address using the ThreatStream WHOIS and DomainTools enrichments configured for your organization.

Syntax

|whois [PARSED=<parse_whois_output>] <field or value>

<field or value>

Specify the IOC or value to look up.
<parse_whois_output>

Optional. Specify whether to parse the raw WHOIS data into individual structured fields. Possible values:

  • true: Parses the raw WHOIS response. By default, returns whois_data and whois_domain_tools. Additionally, returns new columns:

    • whois_domain_name

    • whois_creation_date

    • whois_domain_status

    • whois_name_servers

    • whois_registrant_name

  • false: returns only the raw whois_data and whois_domain_tools columns.

Default: false.

Usage

You can use the whois operator to retrieve WHOIS enrichment details for an IP address or domain. By default, the operator returns the raw whois_data and whois_domain_tools columns.

When you set PARSED=true, the operator adds the following columns to the results:

  • whois_domain_name: Registered domain name.

  • whois_creation_date: Date the domain was registered.

  • whois_domain_status: Current status of the domain, for example, active.

  • whois_name_servers: Name servers associated with the domain.

  • whois_registrant_name: Name of the domain registrant.

These new columns let you filter, aggregate, and query WHOIS data in downstream queries without manually parsing the raw JSON.

Examples

Example 1: Query WHOIS information for a domain name, enclosed in double quotes.

Copy 
|whois "www.anomali.com"

Example 2: Query WHOIS information for an IP address.

Copy 
|whois "192.0.2.1"

Example 3: Query WHOIS information for an IP address based on a custom user-defined variable.

Copy 
|calc ioc_value = "192.0.2.1" |whois ioc_value

Example 4: Query WHOIS information for indicators filtered by type.

Copy 
iocmatch | where ioc_type = 'domain' | limit 10 | whois indicator

Example 5: Retrieves parsed WHOIS data for an IP address and returns domain name, registrant name, domain server name, domain status, and creation date in structured columns alongside the raw WHOIS response.

Copy 
|whois PARSED=true "8.8.8.8"

Example 6: Retrieves WHOIS registration data for www.google.com.

Copy 
ocsf | whois "www.google.com"