Turn a confirmed phishing finding into a policy block
When your team confirms a domain is phishing, send it through a workflow that prepares a DNSFilter policy block and reports the outcome.
Trigger
Webhook received
Notis starts this workflow when an external tool or custom backend sends an HTTP request.
Action
Add Blacklist Domain To Policy
Blocks a domain for users covered by a policy.
Why this helps
A confirmed threat can remain accessible while someone manually carries the finding from investigation into the filtering policy.
- Reduce the handoff between investigation and policy updates
- Keep the workflow tied to a confirmed finding
- Receive a report of the attempted policy change
Setup
Build it in a few focused steps.
- 1Connect AgentQL and DNSFilter once in the Notis portal.
- 2Create an automation and name it Block a Confirmed Phishing Domain.
- 3Tell Notis to use AgentQL to review the submitted domain, add it to the specified DNSFilter policy only when the request confirms it has been verified as phishing, and report the result.
- 4Choose the Notis webhook trigger and choose where run reports should go.
- 5Test with one real, confirmed phishing domain and an existing policy.
Questions about this workflow
Will it block any domain submitted to the webhook?
The instruction should require an explicit confirmed-phishing signal and the intended policy before adding a block. Test that condition with a real example.
Does the workflow create a policy?
No. It uses the DNSFilter action to add a domain to an existing policy's blocklist.
When this happens · Trigger
Do this · Action
Supported Triggers and Actions
Notis builds workflows that link Agentql to Dnsfilter. A trigger fires from one place; an action lands in another.
Agentql triggers
Dnsfilter actions
Recurring trigger
Notis starts this workflow on a schedule, such as daily, weekly, or during business hours.
Create IP Address
Adds an IP address to a network for filtering policies.
Webhook trigger
Notis starts this workflow when an external tool or custom backend sends an HTTP request.
Add Allowed Application
Allows an application through a policy, regardless of other blocking rules.
Get Application Category
Retrieves details about an application category.
Add Allowlist Domains to Policies
Adds domains to the allow lists of multiple policies, bypassing their filtering rules.
Get Billing Information
Retrieves billing records for an organization, including amounts and billing periods.
Add Blacklist Category To Policy
Adds a content category to a policy’s block list without changing other settings.
Get Category
Retrieves basic information about a category.
Add Blacklist Domain To Policy
Blocks a domain for users covered by a policy.
Connect any two apps with Notis in the middle.
Agentql and Dnsfilter, or any other combination from 1,000+ integrations.
When this happens · Trigger
Do this · Action
Save your first hour today.
7-day trial of any paid plan, with 20$ of usage included.
No card. Works with personal or business Dnsfilter.