Plugin: WHOIS Services for Copilot for Security

Hey, it's me!

WHOIS data plays a crucial role in enhancing security on the internet. Here’s some thoughts on why it’s important:

1. Identifying Cyber Threats:

   • Phishing Attacks: Security researchers use WHOIS data to track down the origins of phishing attacks. By identifying the registrants behind suspicious domains, they can take action to shut down malicious websites.

   • Malware Distribution: WHOIS helps uncover the owners of domains distributing malware. This information aids in preventing further infections and protecting users.

   • Botnets and Command-and-Control Servers: WHOIS assists in identifying botnet controllers and command-and-control servers, allowing security teams to disrupt their operations.

2. Enforcing Legal Matters:

   • Intellectual Property Protection: Companies use WHOIS data to protect their trademarks and intellectual property. It helps expose infringement, theft, and misuse of brand names.

   • Legal Investigations: Law enforcement agencies rely on WHOIS records during national and international investigations. It aids in tracking down cybercriminals and gathering evidence.

3. Transparency and Accountability:

   • Network Operators and ISPs: WHOIS provides transparency by allowing network operators, computer incident response teams, and ISPs to contact domain owners for technical issues or abuse reports.

   • Maintaining Internet Integrity: WHOIS ensures accountability by revealing information about domain registrants, registrars, and IP addresses. It helps maintain the integrity of the internet ecosystem.

4. Balancing Privacy and Transparency:

   • Privacy Concerns: With rising privacy concerns, WHOIS privacy services emerged. These services mask personal details of domain owners, balancing transparency with privacy.

   • Impact on Domain Security: While privacy is essential, it can hinder domain security efforts. Striking the right balance is crucial to combat online fraud effectively.

Since WHOIS data is a powerful tool for cybersecurity professionals we should be able to use this information with Copilot for Security. Right?

The Plugin

The Plugin is API-based and this one in particular works with the WhoisXML API service. You’ll need an API from this service to use it. WhoisXML has a free API version for 500 Get functions, but I found that the free version doesn’t actually work due to service restrictions. To use this, you actually have to acquire (purchase) the API service - either through a monthly subscription or by purchasing credits as you go.

To dig deeper into the API, see: https://whois.whoisxmlapi.com/

Get the plugin file: https://github.com/rod-trent/Copilot-for-Security/blob/main/Plugins/WHOIS/WHOIS.yaml

What’s inside the yaml file:

Descriptor:
  Name: WHOIS
  DisplayName: WHOIS
  Description: WHOIS domain lookup  
  Icon: https://github.com/rod-trent/Copilot-for-Security/blob/main/Plugins/WHOIS/WHOIS_icon.png?raw=true
  SupportedAuthTypes:
    - ApiKey
  Authorization:
    Type: APIKey
    Key: apiKey
    Location: QueryParams
    AuthScheme: '' 

SkillGroups:
  - Format: API
    Settings:
      OpenApiSpecUrl: https://raw.githubusercontent.com/rod-trent/Copilot-for-Security/main/Plugins/WHOIS/WHOIS.txt

Examples prompt:

1. WHOIS <domain_name>

To install this in your own Copilot for Security instance, see: Add custom plugins

You will be asked to enter a valid API key after the plugin is installed.

---

[Want to discuss this further? Hit me up on Twitter or LinkedIn]

[Subscribe to the RSS feed for this blog]

[ Subscribe to the Bi-weekly Copilot for Security Newsletter]

[Subscribe to the Weekly Microsoft Sentinel Newsletter]

[Subscribe to the Weekly Microsoft Defender Newsletter]

[Subscribe to the Weekly Azure OpenAI Newsletter]

[Learn KQL with the Must Learn KQL series and book]

[Learn AI Security with the Must Learn AI Security series and book]