Whois Schema

Note

Schema docs show the fields available for normalization. For a schema field to be populated in XDR, its corresponding field defined in the parser must exist in the original data. Normalized data shows in the Normalized Data tab of events and is searchable in XDR only if the corresponding field exists in the original data. The Schema Library in Advanced Search shows only searchable fields.

whois_simple.proto

WhoisRecords

Field	Type	Label	Description
records	WhoisSimple	repeated

WhoisSimple

Field	Type	Label	Description
domainName	string		domain name Eg: abc.com
registrarName	string		the company name of the domain registrar
contactEmail	string		contact email
whoisServer	string		whois server name
nameServers	string		name servers
createdDate	string		creation date in yyyy-MM-dd'T'HHssZ (in some cases there could be variation)
updatedDate	string		update date in yyyy-MM-dd'T'HHssZ (in some cases there could be variation)
expiresDate	string		expires date in yyyy-MM-dd'T'HHssZ (in some cases there could be variation)
standardRegCreatedDate	string		standard Creation date in yyyy-MM-dd HHss UTC (in some cases there could be variation)
standardRegUpdatedDate	string		standard update date in yyyy-MM-dd HHss UTC (in some cases there could be variation)
standardRegExpiresDate	string		standard expires date in yyyy-MM-dd HHss UTC (in some cases there could be variation)
status	string		It can have a range of values like [ok, clientTransferProhibited, clientRenewProhibited, clientUpdateProhibited etc]
Audit_auditUpdatedDate	string		Audit update date in yyyy-MM-dd HHss UTC (in some cases there could be variation)
registrant_email	string		email id
registrant_name	string		name of the entity to which it is registered
registrant_organization	string		Org name
registrant_street1	string		street address
registrant_street2	string
registrant_street3	string
registrant_street4	string
registrant_city	string
registrant_state	string
registrant_postalCode	string
registrant_country	string
registrant_fax	string
registrant_faxExt	string
registrant_telephone	string
registrant_telephoneExt	string
administrativeContact_email	string		admin contact email id
administrativeContact_name	string
administrativeContact_organization	string
administrativeContact_street1	string
administrativeContact_street2	string
administrativeContact_street3	string
administrativeContact_street4	string
administrativeContact_city	string
administrativeContact_state	string
administrativeContact_postalCode	string
administrativeContact_country	string
administrativeContact_fax	string
administrativeContact_faxExt	string
administrativeContact_telephone	string
administrativeContact_telephoneExt	string
reg_created_date_usec	uint64		usec version of standardRegCreatedDate
reg_updated_date_usec	uint64		usec version of standardRegUpdatedDate
reg_expires_date_usec	uint64		usec version of standardRegExpiresDate