Security Operations Reverse WHOIS Integration
Enrich security incidents with Reverse Whois domain information.
Install Trend
View Install Data
| Date | Install Count | Change |
|---|---|---|
| 2026-09-09 | 0 | - |
| 134 days of no change | ||
| 2026-04-27 | 34 | -34 |
| 21 days of no change | ||
| 2026-04-05 | 35 | -1 |
| 64 days of no change | ||
| 2026-01-30 | 36 | -1 |
| 311 days of no change | ||
| 2025-03-24 | 35 | +1 |
About
Reverse Whois is a service that performs searches on domain names registered by individuals or organizations. Domain registration information includes the list of all registered domains, active and historical domains, based on a search term consisting of an organization name, registrant email, or registrant phone number. When integrated with ServiceNow Security Operations, this registered domain information provides additional enrichment data and insight for security incidents or investigations.
Key Features
- Enrichment lookups are run on selected observables upon incident creation.
- After the application is configured and observables are added, the workflow launches, and Reverse Whois lookup execution and completion status are recorded in work notes.
- Results are displayed in the Reverse Whois Domains tab under Related Links.