TruSTAR is a threat intelligence platform designed to accelerate incident analysis process and exchange of intelligence among various internal and external teams. This document provides a description how paying customers of Farsight can correlate reports and indicators produced by Farsight DNSDB with data stored in their TruSTAR enclaves. This integration will query Farsight's DNSDB and return Passive DNS results for associated indicators.
This integration requires TruSTAR users to be paying customers of FarSight DNSDB. You will also need your FarSights API key.
After you have retrieved your Farsight API key follow these steps:
- Log into TruSTAR Station and go the Explore->Marketplace (https://station.trustar.co/browse/marketplace).
- Click on Closed Sources.
- Click on FarSight logo and fill in your API key.
- Click Submit.
TruSTAR will validate and enable the FarSight DNSDB integration within 48 hours. You will receive an email from us informing you as soon as it is enabled.
After the integration in enabled you should see it reports from FarsSight being submitted into an enclave you control on TruSTAR.
What data do you currently pull from FarSight DNSDB?
Our integration currently only pulls reports from FarSight that have cyber IOC’s.
- URL (Domains are extracted from URL)
How often is the data pulled?
Our integration retrieves data from FarSight every 15mins.