FarSight

by Elvis Hovor

Introduction

TruSTAR is a threat intelligence platform designed to accelerate incident analysis process and exchange of intelligence among various internal and external teams. This document provides a description how paying customers of Farsight can correlate reports and indicators produced by Farsight DNSDB with data stored in their TruSTAR enclaves. This integration will query Farsight's DNSDB and return Passive DNS results for associated indicators.

Prerequisites

This integration requires TruSTAR users to be paying customers of FarSight DNSDB. You will also need your FarSights API key.

Configure Integration

After you have retrieved your Farsight API key follow these steps:

  1. Log into TruSTAR Station and go the Explore->Marketplace (https://station.trustar.co/browse/marketplace).
  2. Click on Closed Sources.
  3. Click on FarSight logo and fill in your API key.
  4. Click Submit.

TruSTAR will validate and enable the FarSight DNSDB integration within 48 hours. You will receive an email from us informing you as soon as it is enabled.


After the integration in enabled you should see it reports from FarsSight being submitted into an enclave you control on TruSTAR.

    FAQ

    What data do you currently pull from FarSight DNSDB? 

    Our integration currently only pulls reports from FarSight that have cyber IOC’s.

      These include:

      • IP
      • Domain
      • URL (Domains are extracted from URL)
      Please contact us if you would like to discuss additional indicators that can be queried from FarSight DNSDB.

          How often is the data pulled?

          Our integration retrieves data from FarSight every 15mins.

          Please reach out to support@trustar.co for any additional questions.

          How Did We Do?