Silent Push Integration Installation and Configuration Guide
- 11 Oct 2024
- 12 Minutes to read
-
Print
-
DarkLight
Silent Push Integration Installation and Configuration Guide
- Updated on 11 Oct 2024
- 12 Minutes to read
-
Print
-
DarkLight
Article summary
Did you find this summary helpful?
Thank you for your feedback
Software Version
This guide applies to the Silent Push Playbook App version 1.0.x.
Overview
The ThreatConnect® integration with Silent Push lets you query the following Silent Push API endpoints within ThreatConnect via the Playbooks feature:
Specifically, the Silent Push Playbook App supports the following actions:
- Domain Enrichment
- Domain Search
- Domain Typosquatting Search
- Forward PADNS Lookup
- Get ASN Reputation
- Get ASN Reputation History
- Get ASN Takedown Reputation
- Get ASN Takedown Reputation History
- Get Bulk Domain Information
- Get Bulk Domain Risk Score
- Get Bulk IPv4 History Information
- Get Bulk IPv4 Information
- Get Bulk IPv4 Risk Score
- Get Cousin Domains
- Get Nameserver Reputation
- Get Nameserver Reputation History
- Get Sibling Domains
- Get Subnet Reputation
- Get Subnet Reputation History
- IPv4 Enrichment
- Multicondition PADNS Lookup
- Reverse PADNS Lookup
- Advanced Request
Dependencies
ThreatConnect Dependencies
- ThreatConnect instance with version 7.4.0 or newer installed
Note
All ThreatConnect dependencies will be provided by default to subscribing ThreatConnect Cloud customers. Customers on Dedicated Cloud and On-Premises instances can enable these settings on the Account Settings screen within their ThreatConnect instance.
Silent Push Dependencies
Application Installation and Configuration
Step 1: Install the Silent Push Playbook App
Follow these steps to install the Silent Push Playbook App via TC Exchange™:
- Log into ThreatConnect with a System Administrator account.
- Hover over Settings
on the top navigation bar and select TC Exchange Settings. Then select the Catalog tab. - Locate the Silent Push Playbook App on the Catalog tab. Then click Install
in the Options column.
Step 2: Configure the Silent Push Playbook App
After the Silent Push Playbook App is installed successfully, follow these steps to configure the App in a Playbook:
- Log into ThreatConnect with a user account that has an Organization role of Standard User, Sharing User, Organization Administrator, or App Developer.
- Navigate to the Playbooks screen.
- Create a new Playbook or open an existing one. Then add the Silent Push App to the Playbook.
- Edit the Silent Push Playbook App, select an action from the Action dropdown, and then configure the rest of App’s parameters. See the “Available Actions” section for further instruction on configuring the Silent Push Playbook App for each available action.
- Configure the rest of the Playbook as desired. Then activate the Playbook.
Available Actions
The following sections describe each action that the Silent Push Playbook App supports (i.e., the options available in the Action dropdown when configuring the App) and the corresponding configuration parameters.
Domain Enrichment
Use the Domain Enrichment action to retrieve enrichment information for a domain, including the domain’s age, nameserver (NS) reputation, active period, historical listings, and so forth.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| Domain | The domain to query. | String | Required |
| Explain | Specifies whether to show the data used to calculate the scores in the response. Acceptable values:
| String | Optional |
| Scan Data | Specifies whether to show the data collected from host scanning. Acceptable values:
| String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Domain Search
Use the Domain Search action to search for domains that match the specified query parameters.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| Optional query parameters | The query parameters to include in the request. To view a complete list of supported query parameters and their descriptions, see the Silent Push Domain Search documentation. By default, the Silent Push Playbook App includes the following query parameters for the Domain Search action:
| String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Domain Typosquatting Search
Use the Domain Typosquatting Search action to search for typosquatting variations of a domain that match the specified query parameters.
Note
By default, the domain typosquatting search looks for new records with a
first_seen timestamp within the last seven days; however, you can narrow the search timeframe to the last 24 hours. Additionally, only records that have been seen within the last seven days will be considered in a domain typosquatting search.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| Optional query parameters | The query parameters to include in the request. To view a complete list of supported query parameters and their descriptions, see the Silent Push Domain Typosquatting Search documentation. By default, the Silent Push Playbook App includes the following query parameters for the Domain Typosquatting Search action:
| String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Forward PADNS Lookup
Use the Forward PADNS Lookup action to perform a forward lookup of passive DNS data that match the specified query parameters.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| Query Type | The type of query to perform. Acceptable values include the following:
| String | Required |
| Query Name | The name or IP address (IPv4 or IPv6) to query. If querying a name, you may use wildcards (*) in the name string (e.g., sil*push.com). | String | Required |
| Optional query parameters | The query parameters to include in the request. To view a complete list of supported query parameters and their descriptions, see the Silent Push Forward PADNS Lookup documentation. By default, the Silent Push Playbook App includes the following query parameters for the Forward PADNS Lookup action:
| String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Get ASN Reputation
Use the Get ASN Reputation action to retrieve information about the reputation of an ASN.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| ASN | The ASN to query. Do not include the “AS” or “ASN” prefix. | String | Required |
| Explain | Specifies whether to show the data used to calculate the reputation score. Acceptable values:
| String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Get ASN Reputation History
Use the Get ASN Reputation History action to retrieve the reputation history for an ASN.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| ASN | The ASN to query. Do not include the “AS” or “ASN” prefix. | String | Required |
| Explain | Specifies whether to show the data used to calculate the reputation score. Acceptable values:
| String | Optional |
| Limit | The number of results to return. If no value is provided, all results will be returned. | String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Get ASN Takedown Reputation
Use the Get ASN Takedown Reputation action to retrieve the takedown reputation for an ASN.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| ASN | The ASN to query. Do not include the “AS” or “ASN” prefix. | String | Required |
| Explain | Specifies whether to show the data used to calculate the reputation score. Acceptable values:
| String | Optional |
| Limit | The number of results to return. If no value is provided, all results will be returned. | String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Get ASN Takedown Reputation History
Use the Get ASN Takedown Reputation History action to retrieve the takedown reputation history for an ASN.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| ASN | The ASN to query. Do not include the “AS” or “ASN” prefix. | String | Required |
| Explain | Specifies whether to show the data used to calculate the reputation score. Acceptable values:
| String | Optional |
| Limit | The number of results to return. If no value is provided, all results will be returned. | String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Get Bulk Domain Information
Use the Get Bulk Domain Information action to retrieve information for one or more domains.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| Domains | A string array of domains to query (e.g., ["threatconnect.com","google.com"]). Use the Array Operations App to pass the string array to the Silent Push App. | String Array | Required |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Get Bulk Domain Risk Score
Use the Get Bulk Domain Risk Score action to retrieve the Silent Push Risk Score for one or more domains.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| Domains | A string array of domains to query (e.g., ["threatconnect.com","google.com"]). Use the Array Operations App to pass the string array to the Silent Push App. | String Array | Required |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Get Bulk IPv4 History Information
Use the Get Bulk IPv4 History Information action to retrieve historical information for one or more IPv4 addresses on one or more dates. This information is valuable for tracking the network infrastructure and changes related to IP addresses over time.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| IPv4 Addresses | A string array of IPv4 addresses to query (e.g., ["1.1.1.1","9.9.9.9"]). Use the Array Operations App to pass the string array to the Silent Push App. | String Array | Required |
| Dates | A string array of dates to query for each IP address (e.g., ["20240509","20231118"]). Each date must be in yyyymmdd format. Use the Array Operations App to pass the string array to the Silent Push App. | String Array | Required |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Get Bulk IPv4 Information
Use the Get Bulk IPv4 Information action to retrieve information for one or more IPv4 addresses.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| IPv4 Addresses | A string array of IPv4 addresses to query (e.g., ["1.1.1.1","9.9.9.9"]). Use the Array Operations App to pass the string array to the Silent Push App. | String Array | Required |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Get Bulk IPv4 Risk Score
Use the Get Bulk IPv4 Risk Score action to retrieve the Silent Push Risk Score for one or more IPv4 addresses.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| IPv4 Addresses | A string array of IPv4 addresses to query (e.g., ["1.1.1.1","9.9.9.9"]). Use the Array Operations App to pass the string array to the Silent Push App. | String Array | Required |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Get Cousin Domains
Use the Get Cousin Domains action to retrieve the cousin domains of a domain. A cousin domain is a domain that looks deceptively similar to a legitimate target domain.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| Domain | The domain to query. | String | Required |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Get Nameserver Reputation
Use the Get Nameserver Reputation action to retrieve the reputation for a nameserver.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| Nameserver | The nameserver to query (e.g., ns-380.awsdns-47.com). | String | Required |
| Explain | Specifies whether to show the data used to calculate the reputation score. Acceptable values:
| String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Get Nameserver Reputation History
Use the Get Nameserver Reputation History action to retrieve the reputation history for a nameserver.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| Nameserver | The nameserver to query (e.g., ns-380.awsdns-47.com). | String | Required |
| Explain | Specifies whether to show the data used to calculate the reputation score. Acceptable values:
| String | Optional |
| Limit | The number of results to return. If no value is provided, all results will be returned. | String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Get Sibling Domains
Use the Get Sibling Domains action to retrieve the sibling domains of a domain. A sibling domain is a replica of a primary domain in all respects except the name of the domain itself.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| Domain | The domain to query. | String | Required |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Get Subnet Reputation
Use the Get Subnet Reputation action to retrieve the reputation for an IPv4 subnet.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| Subnet | The IPv4 subnet to query. | String | Required |
| Mask | The subnet mask to query. | String | Required |
| Explain | Specifies whether to show the data used to calculate the reputation score. Acceptable values:
| String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Get Subnet Reputation History
Use the Get Subnet Reputation History action to retrieve the reputation history for an IPv4 subnet.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| Subnet | The IPv4 subnet to query. | String | Required |
| Mask | The subnet mask to query. | String | Required |
| Explain | Specifies whether to show the data used to calculate the reputation score. Acceptable values:
| String | Optional |
| Limit | The number of results to return. If no value is provided, all results will be returned. | String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
IPv4 Enrichment
Use the IPv4 Enrichment action to retrieve enrichment information for an IPv4 address, including the IPv4 address’ ASN, characteristics, Silent Push Risk Score, and so forth.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| IPv4 Address | The IPv4 address to query. | String | Required |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Multicondition PADNS Lookup
Use the Multicondition PADNS Lookup action to perform a lookup of passive DNS data based on a query.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| Query Type | The type of query to perform. Acceptable values:
| String | Required |
| Query Name | The name or IP address (IPv4 or IPv6) to query. If querying a name, you may use wildcards (*) in the name string (e.g., sil*push.com). | String | Required |
| Query Answer | The name or IP address (IPv4 or IPv6) to query. If querying a name, you may use wildcards (*) in the name string (e.g., sil*push.com). | String | Required |
| Optional query parameters | The query parameters to include in the request. To view a complete list of supported query parameters and their descriptions, see the Silent Push Multi-condition PADNS Lookup documentation. By default, the Silent Push Playbook App includes the following query parameters for the Multicondition PADNS Lookup action:
| String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Reverse PADNS Lookup
Use the Reverse PADNS Lookup action to perform a reverse lookup of passive DNS data based on a query.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| Query Type | The type of query to perform. Acceptable values:
| String | Required |
| Query Name | The name or IP address (IPv4 or IPv6) to query. If querying a name, you may use wildcards (*) in the name string (e.g., sil*push.com). | String | Required |
| Optional query parameters | The query parameters to include in the request. To view a complete list of supported query parameters and their descriptions, see the Silent Push Reverse PADNS Lookup documentation. By default, the Silent Push Playbook App includes the following query parameters for the Reverse PADNS Lookup action:
| String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Advanced Request
Use the Advanced Request action when you want to make a request to the Silent Push API that is not covered by the predefined actions available in the Silent Push Playbook App.
| Name | Description | Type | Required? |
|---|---|---|---|
| API Key | The Silent Push API key. | String | Required |
| API Endpoint/Path | The Silent Push API endpoint to use in the request. | String | Required |
| HTTP Method | The HTTP method to use in the request. Acceptable Values:
| String | Required |
| Query Parameters | The query parameters to append to the request URL. For sensitive information like API keys, use variables instead of entering the value directly in order to prevent the Playbook from exporting sensitive data. | Key/Value | Optional |
| Exclude Empty/Null Parameters | Specifies whether to exclude query parameters that have a null or empty value (e.g., ?name=). | Boolean | Optional |
| Headers | The headers to include in the request. When using Multi-part Form/File data, do not add a Content-Type header. For sensitive information like API keys, use variables instead of entering the value directly in order to prevent the Playbook from exporting sensitive data. | String | Optional |
| Fail for status | Specifies whether to have the Playbook fail if the response status code is 4XX –5XX. | Boolean | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |
Frequently Asked Questions (FAQ)
How far back do the data provided by Silent Push go?
Silent Push’s data go back to 2017.
Why do I not need to add the “AS” or “ASN” prefix to my ASN value?
The Silent Push API uses the numbers of the ASN only.
What should I do if I receive empty responses from the Silent Push API?
Check your Silent Push API key permissions if the Silent Push API returns empty responses.
ThreatConnect® is a registered trademark, and TC Exchange™ is a trademark, of ThreatConnect, Inc.
30084-01 EN Rev. B
Was this article helpful?
