WhoisXML API integration - Troubleshooting - Support and Troubleshooting

WhoisXML API integration - Troubleshooting Issue  The WhoisXML API integration enables you to submit Whois lookups on domain names and URLs to obtain context on URL observables, and to make better determination on threats.

WhoisXML API Integration uses Rest Message to interact with third party API.Please use the below link to filter Rest Messages associated with VirusTotal Integration

https://instancename.service-now.com/sys_rest_message_list.do?sysparm_query=sys_scope%3Dd822e1180b622200263a089b37673a39

Resolution 1)Enable Rest Debugging properties.

-Set glide.rest.debug = true https://docs.servicenow.com/csh?topicname=debugging-rest-queries.html&version=latest

-Set HTTP Log Level = All for the webservice which you would like to Debug -Set glide.outbound_http.content.max_limit = 100000 .This is useful to view the rest response.Otherwise, response is truncated. https://docs.servicenow.com/csh?topicname=outbound-logging-properties.html&version=latest

2.Goto Threat Intelligence >> IOC Lookups >> Lookups

3.Click New to create a scan request

a)Lookup Source >> VirusTotal

b)Type >> IP or URL

4.Submit

5. Scan Request is Queued in the Lookup Queue. There are 2 types of scan request issued

a)Scan Request b)Report Request

6.If the response is received , scan request state is updated to Complete .

7.Check the System Logs >> Outbound HTTP Requests to view the Request and Response associated with the rest message call.

8.If there are errors in the response use Curl, Postman or SOAP UI to test the Rest Message.This will help to determine if the issue is isolated to ServiceNow platform.Refer whoisapi doc for API, input and output.

https://whoisapi.whoisxmlapi.com/docs