Verify expected results for Reverse Whois
Enrichment results are displayed on the ReverseWhois Domains tab at the bottom of the security incident record. Locate the lookup results to verify that the lookup ran successfully.
시작하기 전에
프로시저
-
If not already open, navigate to and locate the security incident you are working with.
After the application is configured and you have attached an observable, the flow launches automatically. The work notes on the security incident record display the execution and completion status of the lookup.
-
If you cannot verify that the lookup ran successfully, review the work notes
for more information on how to proceed.
-
Navigate to the bottom of the security incident and click the Show
All Related Lists related link.
주:For the filtered lookup results shown in the following figure, the configuration settings in the Reverse Whois API configuration tile were saved with 1991-06-01 entered in the Since date field.Enrichment results are displayed on the ReverseWhois Domains tab. The active domains for this observable are displayed in the Domain column.
-
Click the blue information icon next to an item then click Open
record in the dialog box that is displayed.
The record is displayed with enrichment details, including the raw data.
-
Navigate back to the security incident, and with the ReverseWhois
Domains tab selected, click an observable in the
Observable column to open a record.
The child observables are displayed on the Child Observables tab on the Observable record. The child observables are generated only if the Reverse Whois application has returned domains.