Domain and DNS lookups

SecurityTrails holds data about domains and their DNS records for security teams. A Beam agent reads a record that names a domain, sends the lookup where your rule permits, and writes the returned DNS details back against it. It dates the lookup and notes the source. Domains that resolve to unexpected infrastructure, return conflicting data, or sit on a watchlist are set aside for an analyst to examine. Routine, clean lookups are saved on their own, so teams investigate from fuller records without querying each domain and copying results across by hand.

IP and infrastructure enrichment

SecurityTrails links IP addresses to the hosts and infrastructure behind them. A Beam agent reads records carrying an IP, applies your rule for which details to trust and store, and enriches each with ownership, hosting, and related fields the service reports. Data that contradicts what a record already holds, or that points to flagged infrastructure, is not written silently but raised instead. Addresses tied to a live investigation are routed to an analyst to handle directly. Routine enrichment fills gaps as records arrive, so teams work from context without researching every address one at a time.

Historical record retrieval

SecurityTrails keeps historical DNS and domain records showing how things looked over time. A Beam agent reads a request tied to an investigation, applies your rule for the range and record types that matter, and retrieves the past entries the service holds. It attaches them to the case and notes when they were gathered. Requests spanning very wide ranges, or touching sensitive targets, are held for an analyst to run and interpret. Routine historical lookups are gathered on their own, so investigators see how a domain changed without assembling each timeline by hand.