Edit

Share via

whoisRecord resource type

  • Article

Namespace: microsoft.graph.security

Note

The Microsoft Graph API for Microsoft Defender Threat Intelligence requires an active Defender Threat Intelligence Portal license and API add-on license for the tenant.

Represents a WHOIS record that contains information about a registered host, the contacts for the registered host, and other metadata about the registration.

Microsoft Defender Threat Intelligence supports the WHOIS protocol commonly used in searching public registrars. One of the most common functions of WHOIS in threat infrastructure is to identify or connect disparate entities based on unique data shared within the records.

Inherits from whoisBaseRecord.

Methods

Method Return type Description
List microsoft.graph.security.whoisRecord collection Get a list of whoisRecord objects.
Get microsoft.graph.security.whoisRecord Get the specified whoisRecord resource.

Properties

Property Type Description
abuse microsoft.graph.security.whoisContact The contact information for the abuse contact. Inherited from whoisBaseRecord.
admin microsoft.graph.security.whoisContact The contact information for the admin contact. Inherited from whoisBaseRecord.
billing microsoft.graph.security.whoisContact The contact information for the billing contact. Inherited from whoisBaseRecord.
domainStatus String The domain status for this WHOIS object. Inherited from whoisBaseRecord.
expirationDateTime DateTimeOffset The date and time when this WHOIS record expires with the registrar. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Inherited from whoisBaseRecord.
firstSeenDateTime DateTimeOffset The first seen date and time of this WHOIS record. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Inherited from whoisBaseRecord.
id String The ID for this WHOIS record object. Inherited from whoisBaseRecord.
lastSeenDateTime DateTimeOffset The last seen date and time of this WHOIS record. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Inherited from whoisBaseRecord.
lastUpdateDateTime DateTimeOffset The date and time when this WHOIS record was last modified. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Inherited from whoisBaseRecord.
nameservers microsoft.graph.security.whoisNameserver collection The nameservers for this WHOIS object. Inherited from whoisBaseRecord.
noc microsoft.graph.security.whoisContact The contact information for the noc contact. Inherited from whoisBaseRecord.
rawWhoisText String The raw WHOIS details for this WHOIS object. Inherited from whoisBaseRecord.
registrant microsoft.graph.security.whoisContact The contact information for the registrant contact. Inherited from whoisBaseRecord.
registrar microsoft.graph.security.whoisContact The contact information for the registrar contact. Inherited from whoisBaseRecord.
registrationDateTime DateTimeOffset The date and time when this WHOIS record was registered with a registrar. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Inherited from whoisBaseRecord.
technical microsoft.graph.security.whoisContact The contact information for the technical contact. Inherited from whoisBaseRecord.
whoisServer String The WHOIS server that provides the details. Inherited from whoisBaseRecord.
zone microsoft.graph.security.whoisContact The contact information for the zone contact. Inherited from whoisBaseRecord.

Relationships

Relationship Type Description
history microsoft.graph.security.whoisHistoryRecord collection The collection of historical records associated to this WHOIS object.
host microsoft.graph.security.host The host associated to this WHOIS object. Inherited from whoisBaseRecord.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.security.whoisHistoryRecord",
  "abuse": {"@odata.type": "microsoft.graph.security.whoisContact"},
  "admin": {"@odata.type": "microsoft.graph.security.whoisContact"},
  "billing": {"@odata.type": "microsoft.graph.security.whoisContact"},
  "domainStatus": "String",
  "expirationDateTime": "String (timestamp)",
  "firstSeenDateTime": "String (timestamp)",
  "id": "String (identifier)",
  "lastSeenDateTime": "String (timestamp)",
  "lastUpdateDateTime": "String (timestamp)",
  "nameservers": [{"@odata.type": "microsoft.graph.security.whoisNameserver"}],
  "noc": {"@odata.type": "microsoft.graph.security.whoisContact"},
  "rawWhoisText": "String",
  "registrant": {"@odata.type": "microsoft.graph.security.whoisContact"},
  "registrar": {"@odata.type": "microsoft.graph.security.whoisContact"},
  "registrationDateTime": "String (timestamp)",
  "technical": {"@odata.type": "microsoft.graph.security.whoisContact"},
  "whoisServer": "String",
  "zone": {"@odata.type": "microsoft.graph.security.whoisContact"}
}