---
title: "Silent Push Integration Installation and Configuration Guide"
slug: "silent-push-integration-installation-and-configuration-guide"
description: "This article is a user guide for the Silent Push integration with ThreatConnect."
updated: 2024-10-11T12:41:05Z
published: 2024-10-11T12:41:05Z
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Silent Push Integration Installation and Configuration Guide

Software VersionThis guide applies to the **Silent Push**Playbook App version 1.0.*x*.

## Overview

The ThreatConnect® integration with Silent Push lets you query the following Silent Push API endpoints within ThreatConnect via the [Playbooks](https://knowledge.threatconnect.com/docs/playbooks) feature:

- [Domain](https://docs.silentpush.com/domain.html)
- [Enrichment](https://docs.silentpush.com/enrich.html)
- [IPV4](https://docs.silentpush.com/ipv4.html)
- [PADNS](https://docs.silentpush.com/padns.html)
- [Reputation](https://docs.silentpush.com/reputation.html)

Specifically, the **Silent Push**Playbook App supports the following actions:

- Domain Enrichment
- Domain Search
- Domain Typosquatting Search
- Forward PADNS Lookup
- Get ASN Reputation
- Get ASN Reputation History
- Get ASN Takedown Reputation
- Get ASN Takedown Reputation History
- Get Bulk Domain Information
- Get Bulk Domain Risk Score
- Get Bulk IPv4 History Information
- Get Bulk IPv4 Information
- Get Bulk IPv4 Risk Score
- Get Cousin Domains
- Get Nameserver Reputation
- Get Nameserver Reputation History
- Get Sibling Domains
- Get Subnet Reputation
- Get Subnet Reputation History
- IPv4 Enrichment
- Multicondition PADNS Lookup
- Reverse PADNS Lookup
- Advanced Request

## Dependencies

### ThreatConnect Dependencies

- ThreatConnect instance with version 7.4.0 or newer installed

NoteAll ThreatConnect dependencies will be provided by default to subscribing ThreatConnect Cloud customers. Customers on Dedicated Cloud and On-Premises instances can enable these settings on the **Account Settings** screen within their ThreatConnect instance.

### Silent Push Dependencies

- [Silent Push API Key](https://help.silentpush.com/docs/generating-an-api-key-1)

## Application Installation and Configuration

### Step 1: Install the Silent Push Playbook App

Follow these steps to install the **Silent Push** Playbook App via TC Exchange™:

1. Log into ThreatConnect with a System Administrator account.
2. Hover over **Settings![Settings icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Settings%20icon.png)**on the top navigation bar and select **TC Exchange Settings**. Then select the **Catalog**tab.
3. Locate the **Silent Push** Playbook App on the **Catalog**tab. Then click **Install![Plus icon_Dark blue](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Plus%20icon_Dark%20blue.png)**in the **Options**column.

### Step 2: Configure the Silent Push Playbook App

After the **Silent Push**Playbook App is installed successfully, follow these steps to configure the App in a Playbook:

1. Log into ThreatConnect with a user account that has an [Organization role](https://knowledge.threatconnect.com/docs/organization-roles) of Standard User, Sharing User, Organization Administrator, or App Developer.
2. Navigate to the [**Playbooks**screen](https://knowledge.threatconnect.com/docs/the-playbooks-screen).
3. [Create a new Playbook](https://knowledge.threatconnect.com/docs/the-playbooks-screen#creating-a-new-playbook) or open an existing one. Then [add the **Silent Push** App](https://knowledge.threatconnect.com/docs/adding-an-app) to the Playbook.
4. Edit the **Silent Push**Playbook App, select an action from the **Action**dropdown, and then configure the rest of App’s parameters. See the [“Available Actions”](/docs/silent-push-integration-installation-and-configuration-guide#available-actions) section for further instruction on configuring the **Silent Push**Playbook App for each available action. [](https://knowledge.threatconnect.com/docs/designing-a-playbook)
5. [Configure the rest of the Playbook](https://knowledge.threatconnect.com/docs/designing-a-playbook) as desired. Then [activate the Playbook](https://knowledge.threatconnect.com/docs/activating-a-playbook).

## Available Actions

The following sections describe each action that the **Silent Push**Playbook App supports (i.e., the options available in the **Action**dropdown when configuring the App) and the corresponding configuration parameters.

### Domain Enrichment

Use the **Domain Enrichment**action to [retrieve enrichment information for a domain](https://docs.silentpush.com/enrich.html#domain-enrichment), including the domain’s age, nameserver (NS) reputation, active period, historical listings, and so forth.

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| Domain | The domain to query. | String | Required |
| Explain | Specifies whether to show the data used to calculate the scores in the response. Acceptable values: - **False**(default): Do not show the data. - **True**: Show the data. | String | Optional |
| Scan Data | Specifies whether to show the data collected from host scanning. Acceptable values: - **False**(default): Do not show the data. - **True**: Show the data. | String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Domain Search

Use the **Domain Search**action to [search for domains](https://docs.silentpush.com/domain.html#domain-search) that match the specified query parameters.

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| Optional query parameters | The query parameters to include in the request. To view a complete list of supported query parameters and their descriptions, see the [Silent Push Domain Search documentation](https://docs.silentpush.com/domain.html#domain-search). By default, the **Silent Push**Playbook App includes the following query parameters for the **Domain Search**action: - asn - asn_diversity_min - domain - domain_regex - first_seen_min - ip_diversity_all_min - last_seen_min - network - nsname - registrar | String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Domain Typosquatting Search

Use the **Domain Typosquatting Search**action to [search for typosquatting variations of a domain](https://docs.silentpush.com/domain.html#domain-typosquatting-search) that match the specified query parameters.

NoteBy default, the domain typosquatting search looks for new records with a `first_seen` timestamp within the last seven days; however, you can narrow the search timeframe to the last 24 hours. Additionally, only records that have been seen within the last seven days will be considered in a domain typosquatting search.

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| Optional query parameters | The query parameters to include in the request. To view a complete list of supported query parameters and their descriptions, see the [Silent Push Domain Typosquatting Search documentation](https://docs.silentpush.com/domain.html#domain-typosquatting-search). By default, the **Silent Push**Playbook App includes the following query parameters for the **Domain Typosquatting Search**action: - autospoof - first_seen_after - first_seen_before - last_seen_after - last_seen_before - match - net - network - nsname - regex | String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Forward PADNS Lookup

Use the **Forward PADNS Lookup**action to [perform a forward lookup of passive DNS data](https://docs.silentpush.com/padns.html#forward-padns-lookup) that match the specified query parameters.

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| Query Type | The type of query to perform. Acceptable values include the following: - a - aaaa - cname - mx - ns - ptr4 - ptr6 - any - anyipv4 - anyipv6 - soa - txt | String | Required |
| Query Name | The name or IP address (IPv4 or IPv6) to query. If querying a name, you may use wildcards (*****) in the name string (e.g., sil*push.com). | String | Required |
| Optional query parameters | The query parameters to include in the request. To view a complete list of supported query parameters and their descriptions, see the [Silent Push Forward PADNS Lookup documentation](https://docs.silentpush.com/padns.html#forward-padns-lookup). By default, the **Silent Push**Playbook App includes the following query parameters for the **Forward PADNS Lookup**action: - first_seen_after - first_seen_before - last_seen_after - last_seen_before - netmask - regex - subdomains | String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Get ASN Reputation

Use the **Get ASN Reputation**action to [retrieve information about the reputation of an ASN](https://docs.silentpush.com/reputation.html#asn-reputation).

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| ASN | The ASN to query. Do not include the “AS” or “ASN” prefix. | String | Required |
| Explain | Specifies whether to show the data used to calculate the reputation score. Acceptable values: - **False**(default): Do not show the data. - **True**: Show the data. | String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Get ASN Reputation History

Use the **Get ASN Reputation History**action to [retrieve the reputation history for an ASN](https://docs.silentpush.com/reputation.html#asn-reputation-history).

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| ASN | The ASN to query. Do not include the “AS” or “ASN” prefix. | String | Required |
| Explain | Specifies whether to show the data used to calculate the reputation score. Acceptable values: - **False**(default): Do not show the data. - **True**: Show the data. | String | Optional |
| Limit | The number of results to return. If no value is provided, all results will be returned. | String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Get ASN Takedown Reputation

Use the **Get ASN Takedown Reputation**action to [retrieve the takedown reputation for an ASN](https://docs.silentpush.com/reputation.html#asn-takedown-reputation).

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| ASN | The ASN to query. Do not include the “AS” or “ASN” prefix. | String | Required |
| Explain | Specifies whether to show the data used to calculate the reputation score. Acceptable values: - **False**(default): Do not show the data. - **True**: Show the data. | String | Optional |
| Limit | The number of results to return. If no value is provided, all results will be returned. | String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Get ASN Takedown Reputation History

Use the **Get ASN Takedown Reputation History**action to [retrieve the takedown reputation history for an ASN](https://docs.silentpush.com/reputation.html#asn-takedown-reputation-history).

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| ASN | The ASN to query. Do not include the “AS” or “ASN” prefix. | String | Required |
| Explain | Specifies whether to show the data used to calculate the reputation score. Acceptable values: - **False**(default): Do not show the data. - **True**: Show the data. | String | Optional |
| Limit | The number of results to return. If no value is provided, all results will be returned. | String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Get Bulk Domain Information

Use the **Get Bulk Domain Information**action to [retrieve information for one or more domains](https://docs.silentpush.com/domain.html#bulk-domain-information).

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| Domains | A string array of domains to query (e.g., ["threatconnect.com","google.com"]). Use the **[](https://threatconnect.readme.io/docs/array-operations-playbook)**[](https://threatconnect.readme.io/docs/array-operations-playbook)[**Array Operations**App](https://threatconnect.readme.io/docs/array-operations-playbook)[](https://threatconnect.readme.io/docs/array-operations-playbook)**[](https://threatconnect.readme.io/docs/array-operations-playbook)** to pass the string array to the **Silent Push**App. | String Array | Required |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Get Bulk Domain Risk Score

Use the **Get Bulk Domain Risk Score**action to [retrieve the Silent Push Risk Score for one or more domains](https://docs.silentpush.com/domain.html#bulk-silent-push-risk-score-for-a-list-of-domains).

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| Domains | A string array of domains to query (e.g., ["threatconnect.com","google.com"]). Use the [**Array Operations**App](https://threatconnect.readme.io/docs/array-operations-playbook) to pass the string array to the **Silent Push**App. | String Array | Required |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Get Bulk IPv4 History Information

Use the **Get Bulk IPv4 History Information**action to [retrieve historical information for one or more IPv4 addresses on one or more dates](https://docs.silentpush.com/ipv4.html#bulk-ipv4-history-information). This information is valuable for tracking the network infrastructure and changes related to IP addresses over time.

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| IPv4 Addresses | A string array of IPv4 addresses to query (e.g., ["1.1.1.1","9.9.9.9"]). Use the [**Array Operations**App](https://threatconnect.readme.io/docs/array-operations-playbook) to pass the string array to the **Silent Push**App. | String Array | Required |
| Dates | A string array of dates to query for each IP address (e.g., ["20240509","20231118"]). Each date must be in **yyyymmdd**format. Use the [**Array Operations**App](https://threatconnect.readme.io/docs/array-operations-playbook) to pass the string array to the **Silent Push**App. | String Array | Required |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Get Bulk IPv4 Information

Use the **Get Bulk IPv4 Information**action to [retrieve information for one or more IPv4 addresses](https://docs.silentpush.com/ipv4.html#bulk-ipv4-information).

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| IPv4 Addresses | A string array of IPv4 addresses to query (e.g., ["1.1.1.1","9.9.9.9"]). Use the [**Array Operations**App](https://threatconnect.readme.io/docs/array-operations-playbook) to pass the string array to the **Silent Push**App. | String Array | Required |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Get Bulk IPv4 Risk Score

Use the **Get Bulk IPv4 Risk Score**action to [retrieve the Silent Push Risk Score for one or more IPv4 addresses](https://docs.silentpush.com/ipv4.html#bulk-silent-push-risk-score-for-a-list-of-ipv4-addresses).

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| IPv4 Addresses | A string array of IPv4 addresses to query (e.g., ["1.1.1.1","9.9.9.9"]). Use the [**Array Operations**App](https://threatconnect.readme.io/docs/array-operations-playbook) to pass the string array to the **Silent Push**App. | String Array | Required |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Get Cousin Domains

Use the **Get Cousin Domains**action to [retrieve the cousin domains of a domain](https://docs.silentpush.com/domain.html#cousin-domains). A cousin domain is a domain that looks deceptively similar to a legitimate target domain.

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| Domain | The domain to query. | String | Required |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Get Nameserver Reputation

Use the **Get Nameserver Reputation**action to [retrieve the reputation for a nameserver](https://docs.silentpush.com/reputation.html#name-server-reputation).

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| Nameserver | The nameserver to query (e.g., ns-380.awsdns-47.com). | String | Required |
| Explain | Specifies whether to show the data used to calculate the reputation score. Acceptable values: - **False**(default): Do not show the data. - **True**: Show the data. | String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Get Nameserver Reputation History

Use the **Get Nameserver Reputation History**action to [retrieve the reputation history for a nameserver](https://docs.silentpush.com/reputation.html#name-server-reputation-history).

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| Nameserver | The nameserver to query (e.g., ns-380.awsdns-47.com). | String | Required |
| Explain | Specifies whether to show the data used to calculate the reputation score. Acceptable values: - **False**(default): Do not show the data. - **True**: Show the data. | String | Optional |
| Limit | The number of results to return. If no value is provided, all results will be returned. | String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Get Sibling Domains

Use the **Get Sibling Domains**action to [retrieve the sibling domains of a domain](https://docs.silentpush.com/domain.html#sibling-domains). A sibling domain is a replica of a primary domain in all respects except the name of the domain itself.

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| Domain | The domain to query. | String | Required |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Get Subnet Reputation

Use the **Get Subnet Reputation**action to [retrieve the reputation for an IPv4 subnet](https://docs.silentpush.com/reputation.html#subnet-reputation).

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| Subnet | The IPv4 subnet to query. | String | Required |
| Mask | The subnet mask to query. | String | Required |
| Explain | Specifies whether to show the data used to calculate the reputation score. Acceptable values: - **False**(default): Do not show the data. - **True**: Show the data. | String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Get Subnet Reputation History

Use the **Get Subnet Reputation History**action to [retrieve the reputation history for an IPv4 subnet](https://docs.silentpush.com/reputation.html#subnet-reputation-history).

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| Subnet | The IPv4 subnet to query. | String | Required |
| Mask | The subnet mask to query. | String | Required |
| Explain | Specifies whether to show the data used to calculate the reputation score. Acceptable values: - **False**(default): Do not show the data. - **True**: Show the data. | String | Optional |
| Limit | The number of results to return. If no value is provided, all results will be returned. | String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### IPv4 Enrichment

Use the **IPv4 Enrichment**action to [retrieve enrichment information for an IPv4 address](https://docs.silentpush.com/enrich.html#ipv4-enrichment), including the IPv4 address’ ASN, characteristics, Silent Push Risk Score, and so forth.

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| IPv4 Address | The IPv4 address to query. | String | Required |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Multicondition PADNS Lookup

Use the **Multicondition PADNS Lookup**action to [perform a lookup of passive DNS data](https://docs.silentpush.com/padns.html#multi-condition-padns-lookup) based on a query.

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| Query Type | The type of query to perform. Acceptable values: - a - aaaa - cname - mx - ns - ptr4 - ptr6 | String | Required |
| Query Name | The name or IP address (IPv4 or IPv6) to query. If querying a name, you may use wildcards (*****) in the name string (e.g., sil*push.com). | String | Required |
| Query Answer | The name or IP address (IPv4 or IPv6) to query. If querying a name, you may use wildcards (*****) in the name string (e.g., sil*push.com). | String | Required |
| Optional query parameters | The query parameters to include in the request. To view a complete list of supported query parameters and their descriptions, see the [Silent Push Multi-condition PADNS Lookup documentation](https://docs.silentpush.com/padns.html#multi-condition-padns-lookup). By default, the **Silent Push**Playbook App includes the following query parameters for the **Multicondition PADNS Lookup**action: - first_seen_after - first_seen_before - last_seen_after - last_seen_before - netmask - regex - subdomains | String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Reverse PADNS Lookup

Use the **Reverse PADNS Lookup**action to [perform a reverse lookup of passive DNS data](https://docs.silentpush.com/padns.html#reverse-padns-lookup) based on a query.

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| Query Type | The type of query to perform. Acceptable values: - a - aaaa - cname - mx - ns - ptr4 - ptr6 - soa - txt - mxhash - nshash - soahash - txthash | String | Required |
| Query Name | The name or IP address (IPv4 or IPv6) to query. If querying a name, you may use wildcards (*****) in the name string (e.g., sil*push.com). | String | Required |
| Optional query parameters | The query parameters to include in the request. To view a complete list of supported query parameters and their descriptions, see the [Silent Push Reverse PADNS Lookup documentation](https://docs.silentpush.com/padns.html#reverse-padns-lookup). By default, the **Silent Push**Playbook App includes the following query parameters for the **Reverse PADNS Lookup**action: - first_seen_after - first_seen_before - last_seen_after - last_seen_before - netmask - regex - subdomains | String | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

### Advanced Request

Use the **Advanced Request**action when you want to make a request to the [Silent Push API](https://docs.silentpush.com/index.html) that is not covered by the predefined actions available in the **Silent Push**Playbook App.

| Name | Description | Type | Required? |
| --- | --- | --- | --- |
| API Key | The Silent Push API key. | String | Required |
| API Endpoint/Path | The Silent Push API endpoint to use in the request. | String | Required |
| HTTP Method | The HTTP method to use in the request. Acceptable Values: - GET - POST - DELETE - PUT - HEAD - PATCH - OPTIONS | String | Required |
| Query Parameters | The query parameters to append to the request URL. For sensitive information like API keys, use variables instead of entering the value directly in order to prevent the Playbook from exporting sensitive data. | Key/Value | Optional |
| Exclude Empty/Null Parameters | Specifies whether to exclude query parameters that have a null or empty value (e.g., ?name=). | Boolean | Optional |
| Headers | The headers to include in the request. When using Multi-part Form/File data, do not add a **Content-Type** header. For sensitive information like API keys, use variables instead of entering the value directly in order to prevent the Playbook from exporting sensitive data. | String | Optional |
| Fail for status | Specifies whether to have the Playbook fail if the response status code is 4*XX* –5*XX*. | Boolean | Optional |
| Fail on no results | Specifies whether the App will produce a Playbook failure when no results are found. | Boolean | Optional |

## Frequently Asked Questions (FAQ)

**How far back do the data provided by Silent Push go?**

Silent Push’s data go back to 2017.

---

**Why do I not need to add the “AS” or “ASN” prefix to my ASN value?**

The Silent Push API uses the numbers of the ASN only.

---

**What should I do if I receive empty responses from the Silent Push API?**

Check your Silent Push API key permissions if the Silent Push API returns empty responses.

---

*ThreatConnect® is a registered trademark, and TC Exchange™ is a trademark, of ThreatConnect, Inc.*

30084-01 EN Rev. B