id: nameserver-fingerprint
info:
name: NS Fingerprint
author: pdteam
severity: info
tags: dns,ns
dns:
- name: "{{FQDN}}"
type: NS
matchers:
- type: word
words:
- "IN\tNS"
extractors:
- type: regex
group: 1
regex:
- "IN\tNS\t(.+)"