Extracting historical network events (netconns) given a list of domains

netconns-by-domain.py

"""Dump a comma-separated list of domain,ipaddr pairings where the domain
includes at least one element from the list (domains).

Useful for dumping historical name resolution data, compiling lists of
endpoints that have talked to a domain, etc.

Depends on https://github.com/redcanaryco/cbapi2.

"""

from cbapi2 import CbApi2

domains = ['no-ip.org',
           'no-ip.biz',
           'no-ip.info']

CB_URL = ''
CB_API_TOKEN = ''

if __name__ == '__main__':

    c = CbApi2(CB_URL, CB_API_TOKEN, ssl_verify=False)

    result = c.process_search(' or '.join(domains))

    for proc in result:
        for netconn in proc.netconns:
            if any(domain in netconn.dns for domain in domains):
                print '%s,%s' % (netconn.dns, netconn.ipaddr)