Asset Intelligence Ops Intelligence Observability Robotic Data

Data Mapping cfxdm - dm:dns_ip_to_name

DNS Name resolution from IP Address to FQDN

PreviousData Mapping cfxdm - dm:enrich NextData Mapping cfxdm - dm:dns_name_to_ip

Last updated 3 years ago

Data Mapping cfxdm - dm:dns_ip_to_name

DNS Name resolution from IP Address to FQDN

dm:dns_ip_to_name: It allows to resolve the IP addresses listed in a column to FQDN names into another column.

dm:dns_ip_to_name: Syntax

from_cols (mandatory): Comma-separated list of column names which has IP Address values
to_cols (mandatory): Comma-separated list of column names to store resolved DNS Names (FQDN).
keep_value (optional): If it is set to 'yes', it stores the original value, else it stores the 'null' value. By default, it is set to 'no'
num_threads (optional): Number of DNS lookup threads. Must be in the range of 1 to 20, Default is set to 5.

This function uses the DNS servers configured on the host os where RDA is installed and running for IP Address to DNS or FQDN name resolution.

It requires an input dataset or a tag that has one or more columns with IP Address values.

Example 1:

Step 1: Create an empty dm_dns_ip_to_name_example_1 using AIOps studio as shown in the below screenshot

Step 2: Add the following pipeline code/commands into the above-created pipeline as shown in the below screenshot:

You can copy the below code into your pipeline and execute that in your environment.

###### Pipeline created a dataset with ip_address, process_name and pid (runtime ###### information on a windows box. ###### Pipeline uses dm:dns_ip_to_name function to resolve name using DNS server using ###### RDA macahine where it is installed @dm:empty --> @dm:addrow ip_address = '10.95.122.221' & process_name = 'System Process' & pid = 0 --> @dm:addrow ip_address = '10.95.122.221' & process_name = 'svchost.exe' & pid = 1020 --> @dm:addrow ip_address = '10.95.122.221' & process_name = 'svchost.exe' & pid = 1020 --> @dm:addrow ip_address = '10.95.122.221' & process_name = 'silsvc.exe' & pid = 1064 --> @dm:addrow ip_address = '10.95.159.100' & process_name = 'smbhash.exe' & pid = 1152 --> @dm:addrow ip_address = '10.95.122.221' & process_name = 'svchost.exe' & pid = 1172 --> @dm:dns_ip_to_name from_cols = 'ip_address' & to_cols = 'fqdn' & keep_value = 'yes'

Step 3: Click verify button to verify the pipeline. RDA will verify the pipeline without any errors (as shown below)

Step 4: Click execute button to execute the pipeline. RDA will execute the pipeline without any errors (as shown below)

Step 5: Verify that the ip_address field as part of the dataset is resolved and print the FQDN (full qualified domain name) using DNS resolution as shown in the below screenshot.