Screen CQL Matches for Domain Threats
Turn a precise Confluence query into an automatic domain screening queue.
Trigger
New CQL Content Match
Triggers when new Confluence content appears that matches a user-provided CQL query.
Action
Suggest Domain Threat
Tool to suggest a fqdn as a potential threat. use after identifying a suspicious domain to verify its threat categorization.
Why this helps
CQL can find relevant content, but domain triage still gets handled manually.
- Uses targeted content discovery
- Prioritizes suspicious domains
- Reduces repetitive security searches
Setup
Build it in a few focused steps.
- 1Connect Confluence and Dnsfilter in Notis.
- 2Create an automation for CQL domain screening.
- 3Ask Notis to extract candidate domains from each match and submit suspicious ones for Dnsfilter threat suggestions.
- 4Choose New CQL Content Match as the trigger and select a report channel.
- 5Test with one CQL query that finds security content.
Questions about this workflow
Who supplies the CQL query?
You provide the query when configuring the Confluence trigger.
Can it submit every domain?
Tell Notis to submit only domains with suspicious context or incident relevance.
When this happens · Trigger
Do this · Action
Supported Triggers and Actions
Notis builds workflows that link Confluence to Dnsfilter. A trigger fires from one place; an action lands in another.
Confluence triggers
Dnsfilter actions
Recurring trigger
Notis starts this workflow on a schedule, such as daily, weekly, or during business hours.
Create IP Address
Tool to create a new ip address in dnsfilter. use after confirming the target network id exists.
Webhook trigger
Notis starts this workflow when an external tool or custom backend sends an HTTP request.
Get Application Category
Tool to get basic information of a specific application category. use when you need details for a given application category id.
New Attachment Added
Triggers when a new attachment is uploaded to a Confluence page. Optionally filters by media type.
Get Billing Information
Tool to retrieve basic billing information for an organization. use when you need to obtain billing details for reporting or automation tasks.
Blog Post Added to Label
Triggers when a new blog post is added to a specific label in Confluence.
Get Category
Tool to get basic information of a specific category. use when you need to retrieve details for a category by its id.
Blogpost Inline Comment Added
Triggers when a new inline comment is added to a Confluence blog post.
Get IP Address
Tool to get basic information of the specified ip address. use when you need to fetch metadata for a particular ip after authentication.
Blog Post Like Count Changed
Triggers when a Confluence blog post's like count changes (someone likes or unlikes).
List All Categories
Tool to list all categories including internal categories. use when you need the complete set of filtering categories.
Blog Post Updated
Triggers when a Confluence blog post is updated (any edit that creates a new version).
List All IP Addresses
Tool to list all user-associated ip addresses. use when you need a comprehensive list of all ip address entries in your organization.
Content Restrictions Changed
Triggers when view or edit restrictions change on a Confluence page or blog post. Detects user/group restrictions being added, removed, or modified.
List All MAC Addresses
Tool to list all mac addresses with basic information. use when you need to retrieve all mac address entries in your organization.
Connect any two apps with Notis in the middle.
Confluence and Dnsfilter, or any other combination from 1,000+ integrations.
When this happens · Trigger
Do this · Action
Save your first hour today.
7-day trial of any paid plan, with 20$ of usage included.
No card. Works with personal or business Dnsfilter.