The CIRCL Passive DNS operation for ThreatQ allows users to query the CIRCL Passive DNS database for selected indicators in the ThreatQ Threat Library.

The operation provides the following action:

• Query CIRCL Passive DNS - queries the Query CIRCL Passive DNS database for FQDN and IP Address indicator sub-types.

The operation is compatible with the following indicator types:

• FQDN
• IP Address