Better orientation of passivetotal data

[r0ny123]

Ideas

• At the moment, the sructure of the data, processed from PassiveTotal, in MISP, is not that better like Domaintools. It should be something like this i.e.

- Attribute                value
- whois email           abcd@ef.com
- whois Registrar      some registrar

• Also the pDNS, subdomains (all these missing corrently) etc. should be available via enrich module. If possible please add other data too ( see image below) i.e. Trackers, Component (very useful while tracking c2 infra)
• Add support for pivoting valuse from passivetotal.

[adulau]

Do you know if the Microsoft version of PassiveTotal improved and if the API changed over the previous version of RiskIQ?

[r0ny123]

There may be some change as well as improvement for sure. There is documentation available here https://passivetotal.readthedocs.io/en/latest/index.html and https://api.riskiq.net/api/concepts.html.