RiskIQ Passive Total (Deprecated)
Supported by Filigran
Infrastructure & Attack Surface Visibility
Overview
[DEPRECATED] Enriches domain and IP observables in OpenCTI with RiskIQ PassiveTotal passive DNS history and infrastructure pivot data. RiskIQ has been acquired by Microsoft.
This connector is deprecated. RiskIQ was acquired by Microsoft and the PassiveTotal service has been integrated into Microsoft Defender Threat Intelligence.
RiskIQ PassiveTotal was a threat intelligence platform providing passive DNS data, WHOIS history, SSL certificate tracking, and infrastructure pivot capabilities. It allowed security teams to map attacker infrastructure by tracing connections between domains, IP addresses, and certificates over time.
This connector enriched IPv4 and Domain observables in OpenCTI by querying the PassiveTotal API, retrieving DNS resolution history and creating relationships between domains and their resolved IP addresses.