[dnstwist-command]
syntax	    = dnstwist (<dnstwist-options>)*
shortdesc   = Perform word permutations on a domain, or list of domains
description = Perform domain permutations on a domain, provided list of domains or domains part of Splunk_SA_CIM lookups
usage       = public
maintainer  = Splunk Security Research <research@splunk.com>
example1    = |dnstwist domainlist=domains.csv
comment1    = Performs word premutation on a list of domains provided under DA-ESS-ContentUpdate/lookup/domains.csv
example2    = |dnstwist domain=www.splunk.com
comment2    = Performs word premutation on a single domain
example3    = |dnstwist populate_from_cim=true
comment3    = Performs word premutation on cim_corporate_email_domains.csv and cim_corporate_web_domains.csv from Splunk_SA_CIM

[dnstwist-options]
syntax 	    = domainlist=<string> | domain=<string> | populate_from_cim=<bool>
description = Prove the name of a lookup file with the list of domains, or individual domain you want to create permutations of.

# runstory functionality was migrated to: https://github.com/splunk/analytic_story_execution
# [runstory-command]
# syntax      = runstory <analytic_story_name>
# shortdesc   = Run an analytic story
# description = Run all the detection searches in an analytic story
# maintainer  = Splunk Security Research
# example1    = | runstory "Malicious PowerShell"
# example2    = | runstory "AWS Cryptomining"
# usage       = public