원클릭으로 Manus에서 모든 스킬 실행

global-dns-integration

스타1

포크0

업데이트2026년 4월 26일 19:43

DNS resolution, reverse lookups, and mail/TXT/NS/SOA queries via Analysi's Global DNS for SOC triage. Use when investigating suspicious domains, resolving IPs to hostnames, checking SPF/DKIM/DMARC in phishing analysis, or correlating network indicators with domain infrastructure.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

open-analysi

open-analysi/analysi-app

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

Global DNS — SOC Investigation Guide

DNS is foundational to alert triage: every domain in an alert can be resolved, every IP can be reverse-looked-up, and email security records reveal whether a sender domain is legitimate. This integration provides free, unauthenticated DNS queries via the runtime's system resolver.

Reference Loading Guide

Reference	Read when	Consult for
`references/actions-reference.md`	Calling any Global DNS action	Integration config, parameters, return schemas, Cy examples, error types, runtime behavior, known limitations
`references/investigation-patterns.md`	Building triage workflows	Phishing domain analysis, DKIM verification, DMARC org-domain fallback, IP-to-hostname correlation, PTR input normalization, batch enrichment, corroboration chains, TP/FP signals, Cy task templates

Quick Decision Path

Suspicious domain → resolve_domain for IPs, get_txt_records for SPF/DMARC, get_mx_records for mail infra, get_ns_records for hosting provider
Suspicious IP → reverse_lookup for hostname, then resolve_domain on result for forward-reverse consistency (FCrDNS)
Phishing alert → Full email security: get_txt_records on domain + _dmarc.{domain}, DKIM via {selector}._domainkey.{domain} (selector from email header), plus MX and NS checks
Lateral movement / C2 → reverse_lookup on destination IPs, compare hostnames against expected internal naming conventions
Zone metadata → get_soa_record for admin contact (rname), negative-cache TTL (minimum), and zone serial (version counter, not creation date)

Available Actions

Six tool actions in Cy: resolve_domain, reverse_lookup, get_mx_records, get_txt_records, get_ns_records, get_soa_record. A health_check connector action exists for integration monitoring but is not callable in Cy.

Not Available

DNSSEC validation — not supported; use external tools for chain-of-trust verification
Bulk/batch DNS queries — no batch action; loop in Cy with a cap (see investigation patterns for safe batch guidance)
Historical/passive DNS — only live resolution; use VirusTotal or Splunk for historical records
WHOIS data — not a DNS action; use a dedicated WHOIS integration
DKIM selector discovery — DNS cannot enumerate selectors; extract s= from the email's DKIM-Signature header first
TTLs, authority/additional sections — not returned by any action
Custom resolver selection — dns_server setting is informational only; the runtime's system resolver is always used

이 저장소의 다른 Skills

같은 저장소

abuseipdb-integration

open-analysi/analysi-app

AbuseIPDB IP reputation lookups for SOC alert triage via Analysi. Use when checking IP abuse confidence scores, investigating brute force or scanning activity, or enriching alerts with crowd-sourced threat intelligence.

2026-04-261

ad-ldap-integration

open-analysi/analysi-app

Active Directory LDAP user attribute lookups and identity context queries during SOC alert triage. Use when investigating user accounts, group memberships, authentication anomalies, lockouts, privileged access, or correlating alerts with AD data via Analysi.

2026-04-261

cy-language-programming

open-analysi/analysi-app

Write and debug Cy language scripts for automation and workflow composition. Use when working with .cy files, Security Tasks, writing Cy programs, or debugging Cy syntax errors.

2026-04-261

cybersecurity-analyst

open-analysi/analysi-app

Investigate security alerts, analyze IOCs, triage incidents, and perform threat analysis. Covers SIEM alerts, SOC workflows, malware, phishing, brute force, web attacks, network traffic, and log analysis. Use when building cybersecurity Tasks/Workflows or performing incident response.

2026-04-261

echo-edr-integration

open-analysi/analysi-app

Echo EDR endpoint detection and response for SOC alert triage. Use when investigating endpoint threats, checking process activity, retrieving host attributes, analyzing behavioral indicators, or correlating endpoint telemetry with alert data via Analysi.

2026-04-261

hypothesis-building-task

open-analysi/analysi-app

Build hypothesis generation tasks for security investigation workflows. Use when creating tasks that form investigation hypotheses from runbooks. These tasks combine static hypotheses (baked in at Kea-time) with dynamic LLM augmentation (at runtime).

2026-04-261

name	global-dns-integration
version	0.1.0
description	DNS resolution, reverse lookups, and mail/TXT/NS/SOA queries via Analysi's Global DNS for SOC triage. Use when investigating suspicious domains, resolving IPs to hostnames, checking SPF/DKIM/DMARC in phishing analysis, or correlating network indicators with domain infrastructure.

Global DNS — SOC Investigation Guide

Reference Loading Guide

Reference	Read when	Consult for
`references/actions-reference.md`	Calling any Global DNS action	Integration config, parameters, return schemas, Cy examples, error types, runtime behavior, known limitations
`references/investigation-patterns.md`	Building triage workflows	Phishing domain analysis, DKIM verification, DMARC org-domain fallback, IP-to-hostname correlation, PTR input normalization, batch enrichment, corroboration chains, TP/FP signals, Cy task templates

Quick Decision Path

Suspicious domain → resolve_domain for IPs, get_txt_records for SPF/DMARC, get_mx_records for mail infra, get_ns_records for hosting provider
Suspicious IP → reverse_lookup for hostname, then resolve_domain on result for forward-reverse consistency (FCrDNS)
Phishing alert → Full email security: get_txt_records on domain + _dmarc.{domain}, DKIM via {selector}._domainkey.{domain} (selector from email header), plus MX and NS checks
Lateral movement / C2 → reverse_lookup on destination IPs, compare hostnames against expected internal naming conventions
Zone metadata → get_soa_record for admin contact (rname), negative-cache TTL (minimum), and zone serial (version counter, not creation date)

Available Actions

Not Available

DNSSEC validation — not supported; use external tools for chain-of-trust verification
Bulk/batch DNS queries — no batch action; loop in Cy with a cap (see investigation patterns for safe batch guidance)
Historical/passive DNS — only live resolution; use VirusTotal or Splunk for historical records
WHOIS data — not a DNS action; use a dedicated WHOIS integration
DKIM selector discovery — DNS cannot enumerate selectors; extract s= from the email's DKIM-Signature header first
TTLs, authority/additional sections — not returned by any action
Custom resolver selection — dns_server setting is informational only; the runtime's system resolver is always used