add queries for shodan-domain resources (#160)

i added some queries to get the information about a domain name Signed-off-by: Patrick Münch <patrick.muench1111@gmail.com>
mondoohq · Aug 26, 2024 · 936da02 · 936da02
1 parent 481636a
commit 936da02
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 3 deletions.
diff --git a/.github/actions/spelling/expect.txt b/.github/actions/spelling/expect.txt
@@ -4,6 +4,7 @@ cea
 CUSTOMERID
 linux
 mpim
+nsrecords
 openssh
 saas
 spdx

diff --git a/core/mondoo-shodan-inventory.mql.yaml b/core/mondoo-shodan-inventory.mql.yaml
@@ -28,43 +28,65 @@ packs:
         Our goal is to build query packs that are simple to deploy and provide accurate and useful data. 
 
         If you have any suggestions for improving this query pack, or if you need support, [join the Mondoo community](https://github.com/orgs/mondoohq/discussions) in GitHub Discussions.
-    filters:
-      - mql: asset.platform == "shodan-host"
+    filters: asset.family.contains("shodan")
     queries:
       - uid: mondoo-shodan-inventory-hostnames
         title: Shodan info about Hostnames / DNS
+        filters: asset.platform == "shodan-host"
         mql: |
           shodan.host.hostnames
       - uid: mondoo-shodan-inventory-asn
         title: Shodan info about ASN
+        filters: asset.platform == "shodan-host"
         mql: |
           shodan.host.asn
       - uid: mondoo-shodan-inventory-tags
         title: Shodan info about Tags
+        filters: asset.platform == "shodan-host"
         mql: |
           shodan.host.tags
       - uid: mondoo-shodan-inventory-isp
         title: Shodan info about ISP
+        filters: asset.platform == "shodan-host"
         mql: |
           shodan.host.isp
       - uid: mondoo-shodan-inventory-org
         title: Shodan info about Org
+        filters: asset.platform == "shodan-host"
         mql: |
           shodan.host.org
       - uid: mondoo-shodan-inventory-ip
         title: Shodan info about IP
+        filters: asset.platform == "shodan-host"
         mql: |
           shodan.host.ip
       - uid: mondoo-shodan-inventory-os
         title: Shodan info about OS
+        filters: asset.platform == "shodan-host"
         mql: |
           shodan.host.os
       - uid: mondoo-shodan-inventory-ports
         title: Shodan info about Ports
+        filters: asset.platform == "shodan-host"
         mql: |
           shodan.host.ports
       - uid: mondoo-shodan-inventory-vulns
         title: Shodan info about vulnerabilities
+        filters: asset.platform == "shodan-host"
         mql: |
           shodan.host.vulnerabilities
-   
+      - uid: mondoo-shodan-inventory-nsrecords
+        title: Shodan info about DNS NS records
+        filters: asset.platform == "shodan-domain"
+        mql: |
+          shodan.domain.nsrecords
+      - uid: mondoo-shodan-inventory-subdomains
+        title: Shodan info about Subdomains
+        filters: asset.platform == "shodan-domain"
+        mql: |
+          shodan.domain.subdomains
+      - uid: mondoo-shodan-inventory-tags
+        title: Shodan info about Tags
+        filters: asset.platform == "shodan-domain"
+        mql: |
+          shodan.domain.tags