Skip to content
DomainTools Technical Documentation

Splunk Enterprise app Farsight DNSDB

Investigate current and historical domain infrastructure with Passive DNS (pDNS) using Farsight’s DNSDB Standard or Flexible search (API Key Required). Enter your Farsight DNSDB API key in DT Settings > API Keys.

DNSDB is a database that stores and indexes both the passive DNS data available via Farsight SIE, as well as the authoritative DNS data that various zone operators make available.

Section titled “pDNS Standard Search”

A search tool used to uncover related infrastructure against a specific Domain or IP.

See the DNSDB API V2 Reference.

  • Time range
  • Resource Record Type (RRType)
    • Optionally specify which Resource Record Type (RRType) to search for. RRType declares the type of mapping that a Resource Record Set establishes. ANY matches all RRTypes except DNSSEC RRTypes and is the default. ANY-DNSSEC matches only the DNSSEC RRTypes.
  • OR Add Custom RRTYPE
  • IP, Domain Name, FQDN, or Subnet
    • Specify an IP (IPv4/IPv6), CIDR netblock, hostname (FQDN), or domain to search for. Left- or right-side wildcards are supported. Internationalized Domain Names (IDNs) are automatically converted to Punycode.
Section titled “pDNS Flexible Search”

Flexible Search supports wildcards and regular expressions, which Standard Search doesn’t. In exchange, its results aren’t as complete as those from Standard Search.

See the DNSDB Flexible Search Query Tool Reference.

  • Select a time range
  • Query
    • Flexible searches support strings and patterns. This field uses the syntax selected under Match type — for example, bank or north.*bank. For an expanded explanation, see the documentation linked above or the user guide.
  • Query type
    • Specifies which field of the DNS resource record to search. The options are RDATA (Right-Hand) and RRName (Left-Hand). RDATA is the record data value, or the “right-hand side” of a DNS resource record set; its content can be IP addresses, domain names, or other content (such as text), depending on the RRType. An RRName is the owner name of the RRset, or the “left-hand side” of a DNS resource record set; it is always a domain name.
  • Match type
    • Which flexible search syntax to use: Regex or Glob. Regex is more common and represents the egrep-like Farsight Compatible Regular Expression (“FCRE”) syntax; Glob is simpler wildcard pattern matching. See the documentation linked above for examples.
  • Resource Record Type (RRType)
    • Optionally specify which Resource Record Type (RRType) to search for. RRType declares the type of mapping that a Resource Record Set establishes. ANY matches all RRTypes except DNSSEC RRTypes and is the default. ANY-DNSSEC matches only the DNSSEC RRTypes.
Section titled “DNSDB Splunk Search”

To query Farsight DNSDB from SPL instead of these UI pages, use the DNSDB custom search commands — dtdnsdb, dtdnsdbflex, dtdnsdblimit, and dtdnsdbenrich. See Custom search commands on the Search page for syntax, parameters, and examples.

Section titled “Related resources”