Publisher: DomainTools
Connector Version: 2.0.0
Product Vendor: DomainTools
Product Name: DomainTools Iris Investigate
Minimum Product Version: 6.3.1
This app supports investigative actions to profile domain names, get risk scores, and find connected domains that share the same Whois details, web hosting profiles, SSL certificates, and more on DomainTools Iris Investigate
This feature allows the user to schedule playbooks to run on an specified interval and run it on a specific container/event ID you provided on each row. Coupled with our reference playbooks, linked below, this can be a powerful tool to notify you of domain infrastructure changes, or when newly created domains match specific infrastructure you're monitoring. See the individual playbooks for more information. This readme covers how to set up Iris Monitoring for those playbooks.
This feature depends on the 1 asset configuration fields that are required when using this feature.
| Name | Description | Default Value | Required |
|---|---|---|---|
| Splunk SOAR HTTPS port (default: 8443) | Splunk SOAR HTTP port if your instance uses one other than the default, 8443 | 8443 | Yes |
To configure this, you need to:
- Go to Apps
- Select DomainTools Iris Investigate
- Select a configured asset or create one if you don't have any.
- Go to Asset Settings
- Look for
Splunk SOAR HTTPS port (default: 8443)field. By default it contains8443value.
This feature uses a custom list named domaintools_scheduled_playbooks.
To generate the custom list, you need to:
- Go to Apps
- Select DomainTools Iris Investigate 3, Select a configured asset or create one if you don't have any.
- Go to Actions dropdown then;
- Select '
configure scheduled playbooks' action, then; - Hit
Test Action.
If you go back to custom list page. you should have the domaintools_scheduled_playbooks generated for you.
Note: The values of this list has 6 columns and the header should not be altered. The last 3 columns are intentionally left blank and used by the playbook scheduler.
Sample domaintools_scheduled_playbooks table:
| repo/playbook_name | event_id | interval (mins) | last_run (server time) | last_run_status | remarks |
|---|---|---|---|---|---|
local/DomainTools Monitor Domain Risk Score | <your_event_id> | 1440 | |||
local/DomainTools Monitor Domain Infrastructure | <your_event_id> | 1440 | |||
local/DomainTools Monitor Search Hash | <your_event_id> | 1440 | |||
| In this example, we've specified to run three separate monitoring playbooks on daily schedules. Note that each scheduled lookup will consume Iris Investigate queries, depending how many domains or Iris search hashes are being monitored. |
- Under Apps > DomainTools Iris Investigate > Asset Settings > Ingest Settings > Label, specify or select a label to apply to objects from this source.
Recommended: Use a custom label rather using a predefined label likeevents. - Specify a polling interval to check if playbooks need to be run. Note that this is separate from the playbook run interval specified in step 4. We recommend running every minute for the most accurate scheduling.
- Under Custom Lists >
domaintools_scheduled_playbooksinput your desired playbook schedule following the example in the Configuration Section
Note: Make sure the label of the playbook and event_id you inputted shares the label that you selected in Step 1. Thedomaintools_scheduled_playbookscustom list should have been created when you updated our installed the DomainTools app, but if you don't see it, you can generate it by following the Prerequisites section of this page.
Note: For the DomainTools reference playbooks, see this Github repository.
This table lists the configuration variables required to operate DomainTools Iris Investigate. These variables are specified when configuring a DomainTools Iris Investigate asset in Splunk SOAR.
| VARIABLE | REQUIRED | TYPE | DESCRIPTION |
|---|---|---|---|
| username | required | string | User Name |
| key | required | password | API Key |
| proxy | optional | boolean | Use Proxy |
| proxy_auth | optional | boolean | Use Proxy Authentication |
| proxy_server | optional | string | Proxy Server |
| proxy_username | optional | string | Proxy Username |
| proxy_port | optional | numeric | Proxy Port |
| proxy_password | optional | password | Proxy Password |
| custom_ssl_certificate | optional | boolean | Use Custom SSL Certificate |
| ssl | optional | boolean | Use SSL |
| custom_ssl_certificate_path | optional | string | Custom SSL Certificate Path |
test connectivity - Validate the asset configuration for connectivity
domain reputation - Evaluates the risk of a given domain
pivot action - Find domains connected by any supported Iris Investigate search parameter
reverse domain - Extract IPs from a single domain response for further pivoting
reverse ip - Find domains with web hosting IP, NS IP or MX IP
load hash - Load or monitor Iris Investigate search results by Iris Investigate export hash
reverse email - Find domains with email in Whois, DNS SOA or SSL certificate
lookup domain - Get all Iris Investigate data for a domain using the Iris Investigate API endpoint (required)
enrich domain - Get all Iris Investigate data for a domain except counts using the high volume Iris Enrich API endpoint (if provisioned)
configure scheduled playbooks - Run on initial setup to configure the optional monitoring playbooks. This action creates a custom list to manage the playbook scheduling and run status
on poll - Execute scheduled playbooks based on the set interval(mins) in 'domaintools_scheduled_playbooks' custom list. Smaller intervals will result in more accurate schedules
parsed domain rdap - The Parsed Domain RDAP API returns the most recent Domain-RDAP registration record in response to a HTTP GET query. This API compliments the Parsed Whois API as some registries and registrar are beginning to support RDAP as an alternative to Whois for providing domain registration data
nod feed - Apex-level domains (e.g. example.com but not www.example.com) observed for the first time by the DomainTools sensor network, and which are not present in our DNSDB historical database
nad feed - Apex-level domains (e.g. example.com but not www.example.com) DomainTools has newly observed in our DNS sensor network. This includes domains observed in DNS for the first time as well as domains observed in DNS again after not being observed for at least 10 days
noh feed - Contains fully qualified domain names (i.e. host names) that have never been seen before in passive DNS, emitted as soon as they are first observed. Hostname resolutions that we observe for the first time with our global DNS sensor network
domain discovery feed - New domains as they are either discovered in domain registration information, observed by our global sensor network, or reported by trusted third parties
domain rdap feed - List of records for a given domain may be provided by a domain registry, registrar, or both. Domain registries maintain authoritative information about one or more top-level domains (e.g., .com), while domain registrars manage apex domains (e.g., domaintools.com). When domain information is present from both the registry and registrar, this API presents a record containing both sets of results, as well the original raw JSON record, from both the registry and registrar
domain risk feed - Real-time updates to Domain Risk Scores for apex domains, regardless of observed traffic
domain hotlist feed - Domains with high Domain Risk Scores that have also been active within 24 hours
iris detect get new domains - Retrieve newly discovered domains from Iris Detect across all monitors or a specific monitor
iris detect get watched domains - Retrieve watched domains from Iris Detect across all monitors or a specific monitor
iris detect get ignored domains - Retrieve ignored (false positive) domains from Iris Detect across all monitors or a specific monitor
iris detect get escalated domains - Retrieve domains escalated to Google Safe Browsing from Iris Detect
iris detect get blocklist domains - Retrieve domains escalated for internal blocking from Iris Detect
iris detect get monitors list - Retrieve the list of monitors configured in Iris Detect for your account
iris detect escalate domains - Escalate one or more watched domains to Google Safe Browsing via Iris Detect
iris detect blocklist domains - Escalate one or more watched domains for internal blocking via Iris Detect
iris detect watch domains - Add one or more domains to the Iris Detect watchlist for ongoing monitoring
iris detect ignore domains - Mark one or more domains as ignored (false positives) in Iris Detect
Validate the asset configuration for connectivity
Type: test
Read only: True
No parameters are required for this action
No Output
Evaluates the risk of a given domain
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| domain | required | Domain or comma-separated list of domains to query | string | urldomain |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.parameter.domain | string | urldomain | |
| action_result.data | string | ||
| action_result.status | string | success failed | |
| action_result.message | string | ||
| action_result.summary.domain_risk | numeric | ||
| action_result.summary.zerolisted | boolean | True False | |
| action_result.summary.proximity | numeric | ||
| action_result.summary.threat_profile | numeric | ||
| action_result.summary.threat_profile_malware | numeric | ||
| action_result.summary.threat_profile_phishing | numeric | ||
| action_result.summary.threat_profile_spam | numeric | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
Find domains connected by any supported Iris Investigate search parameter
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| query_value | required | Value to query | string | urldomainipemail |
| pivot_type | required | Field to pivot on | string | |
| status | optional | Return domains of this registration type | string | |
| data_updated_after | optional | Iris Investigate records that were updated on or after midnight on this date, in YYYY-MM-DD format or relative options ( 'today', 'yesterday' ) | string | |
| tld | optional | Limit results to only include domains in a specific top-level domain (i.e. “tld=com” or “tld=ru”) | string | |
| create_date | optional | Only include domains created on a specific date, in YYYY-MM-DD format or relative options ( 'today', 'yesterday' ) | string | |
| create_date_within | optional | Only include domains with a whois create date within the specified number of days (e.g. specifying '1' would indicate within the past day) | string | |
| first_seen_within | optional | Only include domains with a current lifecycle first observed within the specified number of seconds (e.g. specifying '86400' would indicate within the past day) | string | |
| first_seen_since | optional | Only include domains with a current lifecycle first observed since a specified datetime. (Example: 2023-04-10T00:00:00+00:00) | string | |
| expiration_date | optional | Only include domains expiring on a specific date, in YYYY-MM-DD format or relative options ( 'today', 'yesterday' ) | string |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.parameter.create_date | string | ||
| action_result.parameter.create_date_within | string | ||
| action_result.parameter.data_updated_after | string | ||
| action_result.parameter.first_seen_within | string | ||
| action_result.parameter.first_seen_since | string | ||
| action_result.parameter.expiration_date | string | ||
| action_result.data.*.first_seen.count | numeric | ||
| action_result.data.*.first_seen.value | string | ||
| action_result.data.*.server_type.count | numeric | ||
| action_result.data.*.server_type.value | string | ||
| action_result.data.*.website_title.count | numeric | ||
| action_result.data.*.website_title.value | string | ||
| action_result.parameter.pivot_type | string | ||
| action_result.parameter.query_value | string | urldomainipemail | |
| action_result.parameter.status | string | ||
| action_result.parameter.tld | string | ||
| action_result.data.*.domain | string | domain | |
| action_result.data.*.domain_risk.risk_score | numeric | ||
| action_result.data.*.domain_risk.risk_score_string | string | ||
| action_result.status | string | success failed | |
| action_result.message | string | ||
| action_result.summary | string | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
Extract IPs from a single domain response for further pivoting
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| domain | required | Domain or comma-separated list of domains to query | string | urldomain |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.parameter.domain | string | urldomain | |
| action_result.data | string | ||
| action_result.data.*.first_seen.count | numeric | ||
| action_result.data.*.first_seen.value | string | ||
| action_result.data.*.server_type.count | numeric | ||
| action_result.data.*.server_type.value | string | ||
| action_result.data.*.website_title.count | numeric | ||
| action_result.data.*.website_title.value | string | ||
| action_result.status | string | success failed | |
| action_result.message | string | ||
| action_result.summary.ip_list.*.count | numeric | ||
| action_result.summary.ip_list.*.count_string | string | ||
| action_result.summary.ip_list.*.ip | string | ip | |
| action_result.summary.ip_list.*.type | string | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
Find domains with web hosting IP, NS IP or MX IP
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| ip | required | IP address to query | string | ip |
| status | optional | Return domains of this registration type | string | |
| data_updated_after | optional | Iris Investigate records that were updated on or after midnight on this date, in YYYY-MM-DD format or relative options ( 'today', 'yesterday' ) | string | |
| tld | optional | Limit results to only include domains in a specific top-level domain (i.e. “tld=com” or “tld=ru”) | string | |
| create_date | optional | Only include domains created on a specific date, in YYYY-MM-DD format or relative options ( 'today', 'yesterday' ) | string | |
| create_date_within | optional | Only include domains with a whois create date within the specified number of days (e.g. specifying '1' would indicate within the past day) | string | |
| first_seen_within | optional | Only include domains with a current lifecycle first observed within the specified number of seconds (e.g. specifying '86400' would indicate within the past day) | string | |
| first_seen_since | optional | Only include domains with a current lifecycle first observed since a specified datetime. (Example: 2023-04-10T00:00:00+00:00) | string | |
| expiration_date | optional | Only include domains expiring on a specific date, in YYYY-MM-DD format or relative options ( 'today', 'yesterday' ) | string |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.parameter.create_date | string | ||
| action_result.parameter.create_date_within | string | ||
| action_result.parameter.data_updated_after | string | ||
| action_result.parameter.expiration_date | string | ||
| action_result.parameter.first_seen_within | string | ||
| action_result.parameter.first_seen_since | string | ||
| action_result.parameter.ip | string | ip | |
| action_result.parameter.status | string | ||
| action_result.parameter.tld | string | ||
| action_result.data.*.domain | string | domain | |
| action_result.data.*.domain_risk.risk_score | numeric | ||
| action_result.data.*.domain_risk.risk_score_string | string | ||
| action_result.status | string | success failed | |
| action_result.message | string | ||
| action_result.summary | string | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
Load or monitor Iris Investigate search results by Iris Investigate export hash
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| search_hash | required | Paste the "Current Search Export" string (Advanced -> Import/Export Search) from Iris Investigate in this field to import up to 5000 domains | string |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.parameter.search_hash | string | ||
| action_result.data.*.domain | string | domain | |
| action_result.data.*.domain_risk.risk_score | numeric | ||
| action_result.data.*.domain_risk.risk_score_string | string | ||
| action_result.status | string | success failed | |
| action_result.message | string | ||
| action_result.summary | string | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
Find domains with email in Whois, DNS SOA or SSL certificate
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| required | Email query | string | email | |
| status | optional | Return domains of this registration type | string | |
| data_updated_after | optional | Iris Investigate records that were updated on or after midnight on this date, in YYYY-MM-DD format or relative options ( 'today', 'yesterday' ) | string | |
| tld | optional | Limit results to only include domains in a specific top-level domain (i.e. “tld=com” or “tld=ru”) | string | |
| create_date | optional | Only include domains created on a specific date, in YYYY-MM-DD format or relative options ( 'today', 'yesterday' ) | string | |
| create_date_within | optional | Only include domains with a whois create date within the specified number of days (e.g. specifying '1' would indicate within the past day) | string | |
| first_seen_within | optional | Only include domains with a current lifecycle first observed within the specified number of seconds (e.g. specifying '86400' would indicate within the past day) | string | |
| first_seen_since | optional | Only include domains with a current lifecycle first observed since a specified datetime. (Example: 2023-04-10T00:00:00+00:00) | string | |
| expiration_date | optional | Only include domains expiring on a specific date, in YYYY-MM-DD format or relative options ( 'today', 'yesterday' ) | string |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.parameter.create_date | string | ||
| action_result.parameter.create_date_within | string | ||
| action_result.parameter.data_updated_after | string | ||
| action_result.parameter.email | string | email | |
| action_result.parameter.expiration_date | string | ||
| action_result.parameter.first_seen_within | string | ||
| action_result.parameter.first_seen_since | string | ||
| action_result.parameter.status | string | ||
| action_result.parameter.tld | string | ||
| action_result.data.*.domain | string | domain | |
| action_result.data.*.domain_risk.risk_score | numeric | ||
| action_result.data.*.domain_risk.risk_score_string | string | ||
| action_result.data.*.first_seen.count | numeric | ||
| action_result.data.*.first_seen.value | string | ||
| action_result.data.*.server_type.count | numeric | ||
| action_result.data.*.server_type.value | string | ||
| action_result.data.*.website_title.count | numeric | ||
| action_result.data.*.website_title.value | string | ||
| action_result.status | string | success failed | |
| action_result.message | string | ||
| action_result.summary | string | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
Get all Iris Investigate data for a domain using the Iris Investigate API endpoint (required)
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| domain | required | Domain or comma-separated list of domains to query using the Iris Investigate API | string | urldomain |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.status | string | failed success | |
| action_result.parameter.domain | string | urldomain | |
| action_result.data.*.additional_whois_email.*.count | numeric | ||
| action_result.data.*.additional_whois_email.*.value | string | ||
| action_result.data.*.admin_contact.city.count | numeric | ||
| action_result.data.*.admin_contact.city.value | string | ||
| action_result.data.*.admin_contact.country.count | numeric | ||
| action_result.data.*.admin_contact.country.value | string | ||
| action_result.data.*.admin_contact.fax.count | numeric | ||
| action_result.data.*.admin_contact.fax.value | string | ||
| action_result.data.*.admin_contact.name.count | numeric | ||
| action_result.data.*.admin_contact.name.value | string | ||
| action_result.data.*.admin_contact.org.count | numeric | ||
| action_result.data.*.admin_contact.org.value | string | ||
| action_result.data.*.admin_contact.phone.count | numeric | ||
| action_result.data.*.admin_contact.phone.value | string | ||
| action_result.data.*.admin_contact.postal.count | numeric | ||
| action_result.data.*.admin_contact.postal.value | string | ||
| action_result.data.*.admin_contact.state.count | numeric | ||
| action_result.data.*.admin_contact.state.value | string | ||
| action_result.data.*.admin_contact.street.count | numeric | ||
| action_result.data.*.admin_contact.street.value | string | ||
| action_result.data.*.adsense.count | numeric | ||
| action_result.data.*.adsense.value | string | ||
| action_result.data.*.alexa | numeric | ||
| action_result.data.*.billing_contact.city.count | numeric | ||
| action_result.data.*.billing_contact.city.value | string | ||
| action_result.data.*.billing_contact.country.count | numeric | ||
| action_result.data.*.billing_contact.country.value | string | ||
| action_result.data.*.billing_contact.fax.count | numeric | ||
| action_result.data.*.billing_contact.fax.value | string | ||
| action_result.data.*.billing_contact.name.count | numeric | ||
| action_result.data.*.billing_contact.name.value | string | ||
| action_result.data.*.billing_contact.org.count | numeric | ||
| action_result.data.*.billing_contact.org.value | string | ||
| action_result.data.*.billing_contact.phone.count | numeric | ||
| action_result.data.*.billing_contact.phone.value | string | ||
| action_result.data.*.billing_contact.postal.count | numeric | ||
| action_result.data.*.billing_contact.postal.value | string | ||
| action_result.data.*.billing_contact.state.count | numeric | ||
| action_result.data.*.billing_contact.state.value | string | ||
| action_result.data.*.billing_contact.street.count | numeric | ||
| action_result.data.*.billing_contact.street.value | string | ||
| action_result.data.*.create_date.count | numeric | ||
| action_result.data.*.create_date.value | string | ||
| action_result.data.*.domain_risk.risk_score | numeric | ||
| action_result.data.*.email_domain.*.count | numeric | ||
| action_result.data.*.email_domain.*.value | string | ||
| action_result.data.*.expiration_date.count | numeric | ||
| action_result.data.*.expiration_date.value | string | ||
| action_result.data.*.first_seen.count | numeric | ||
| action_result.data.*.first_seen.value | string | ||
| action_result.data.*.google_analytics.count | numeric | ||
| action_result.data.*.google_analytics.value | string | ||
| action_result.data.*.ip.*.address.count | numeric | ||
| action_result.data.*.ip.*.address.value | string | ||
| action_result.data.*.ip.*.asn.*.count | numeric | ||
| action_result.data.*.ip.*.asn.*.value | string | ||
| action_result.data.*.ip.*.country_code.count | numeric | ||
| action_result.data.*.ip.*.country_code.value | string | ||
| action_result.data.*.ip.*.isp.count | numeric | ||
| action_result.data.*.ip.*.isp.value | string | ||
| action_result.data.*.mx.*.domain.count | numeric | ||
| action_result.data.*.mx.*.domain.value | string | ||
| action_result.data.*.mx.*.host.count | numeric | ||
| action_result.data.*.mx.*.host.value | string | ||
| action_result.data.*.mx.*.ip.*.count | numeric | ||
| action_result.data.*.mx.*.ip.*.value | string | ||
| action_result.data.*.name_server.*.domain.count | numeric | ||
| action_result.data.*.name_server.*.domain.value | string | ||
| action_result.data.*.name_server.*.host.count | numeric | ||
| action_result.data.*.name_server.*.host.value | string | ||
| action_result.data.*.name_server.*.ip.*.count | numeric | ||
| action_result.data.*.name_server.*.ip.*.value | string | ||
| action_result.data.*.redirect.count | numeric | ||
| action_result.data.*.redirect.value | string | ||
| action_result.data.*.redirect_domain.count | numeric | ||
| action_result.data.*.redirect_domain.value | string | ||
| action_result.data.*.registrant_contact.city.count | numeric | ||
| action_result.data.*.registrant_contact.city.value | string | ||
| action_result.data.*.registrant_contact.country.count | numeric | ||
| action_result.data.*.registrant_contact.country.value | string | ||
| action_result.data.*.registrant_contact.email.*.value | string | ||
| action_result.data.*.registrant_contact.email.*.count | numeric | ||
| action_result.data.*.registrant_contact.fax.count | numeric | ||
| action_result.data.*.registrant_contact.fax.value | string | ||
| action_result.data.*.registrant_contact.name.count | numeric | ||
| action_result.data.*.registrant_contact.name.value | string | ||
| action_result.data.*.registrant_contact.org.count | numeric | ||
| action_result.data.*.registrant_contact.org.value | string | ||
| action_result.data.*.registrant_contact.phone.count | numeric | ||
| action_result.data.*.registrant_contact.phone.value | string | ||
| action_result.data.*.registrant_contact.postal.count | numeric | ||
| action_result.data.*.registrant_contact.postal.value | string | ||
| action_result.data.*.registrant_contact.state.count | numeric | ||
| action_result.data.*.registrant_contact.state.value | string | ||
| action_result.data.*.registrant_contact.street.count | numeric | ||
| action_result.data.*.registrant_contact.street.value | string | ||
| action_result.data.*.registrant_name.count | numeric | ||
| action_result.data.*.registrant_name.value | string | ||
| action_result.data.*.registrant_org.count | numeric | ||
| action_result.data.*.registrant_org.value | string | ||
| action_result.data.*.registrar.count | numeric | ||
| action_result.data.*.registrar.value | string | ||
| action_result.data.*.server_type.count | numeric | ||
| action_result.data.*.server_type.value | string | ||
| action_result.data.*.soa_email.*.count | numeric | ||
| action_result.data.*.soa_email.*.value | string | ||
| action_result.data.*.ssl_info.*.alt_names.*.count | numeric | ||
| action_result.data.*.ssl_info.*.alt_names.*.value | string | ||
| action_result.data.*.ssl_info.*.common_name.count | numeric | ||
| action_result.data.*.ssl_info.*.common_name.value | string | ||
| action_result.data.*.ssl_info.*.duration.count | numeric | ||
| action_result.data.*.ssl_info.*.duration.value | string | ||
| action_result.data.*.ssl_info.*.email.*.count | numeric | ||
| action_result.data.*.ssl_info.*.email.*.value | string | ||
| action_result.data.*.ssl_info.*.hash.count | numeric | ||
| action_result.data.*.ssl_info.*.hash.value | string | ||
| action_result.data.*.ssl_info.*.issuer_common_name.count | numeric | ||
| action_result.data.*.ssl_info.*.issuer_common_name.value | string | ||
| action_result.data.*.ssl_info.*.not_after.count | numeric | ||
| action_result.data.*.ssl_info.*.not_after.value | string | ||
| action_result.data.*.ssl_info.*.not_before.count | numeric | ||
| action_result.data.*.ssl_info.*.not_before.value | string | ||
| action_result.data.*.ssl_info.*.organization.count | numeric | ||
| action_result.data.*.ssl_info.*.organization.value | string | ||
| action_result.data.*.ssl_info.*.subject.count | numeric | ||
| action_result.data.*.ssl_info.*.subject.value | string | ||
| action_result.data.*.tags.*.label | string | ||
| action_result.data.*.tags.*.scope | string | ||
| action_result.data.*.tags.*.tagged_at | string | ||
| action_result.data.*.technical_contact.city.count | numeric | ||
| action_result.data.*.technical_contact.city.value | string | ||
| action_result.data.*.technical_contact.country.count | numeric | ||
| action_result.data.*.technical_contact.country.value | string | ||
| action_result.data.*.technical_contact.fax.count | numeric | ||
| action_result.data.*.technical_contact.fax.value | string | ||
| action_result.data.*.technical_contact.name.count | numeric | ||
| action_result.data.*.technical_contact.name.value | string | ||
| action_result.data.*.technical_contact.org.count | numeric | ||
| action_result.data.*.technical_contact.org.value | string | ||
| action_result.data.*.technical_contact.phone.count | numeric | ||
| action_result.data.*.technical_contact.phone.value | string | ||
| action_result.data.*.technical_contact.postal.count | numeric | ||
| action_result.data.*.technical_contact.postal.value | string | ||
| action_result.data.*.technical_contact.state.count | numeric | ||
| action_result.data.*.technical_contact.state.value | string | ||
| action_result.data.*.technical_contact.street.count | numeric | ||
| action_result.data.*.technical_contact.street.value | string | ||
| action_result.data.*.tld | string | ||
| action_result.summary | string | ||
| action_result.data.*.website_title.count | numeric | ||
| action_result.data.*.website_title.value | string | ||
| action_result.status | string | success failed | |
| action_result.message | string | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
Get all Iris Investigate data for a domain except counts using the high volume Iris Enrich API endpoint (if provisioned)
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| domain | required | Domain or comma-separated list of domains to query using the Iris Enrich API (if provisioned) | string | urldomain |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.status | string | failed success | |
| action_result.parameter.domain | string | urldomain | |
| action_result.data.*.additional_whois_email.*.value | string | ||
| action_result.data.*.admin_contact.city.value | string | ||
| action_result.data.*.admin_contact.country.value | string | ||
| action_result.data.*.admin_contact.fax.value | string | ||
| action_result.data.*.admin_contact.name.value | string | ||
| action_result.data.*.admin_contact.org.value | string | ||
| action_result.data.*.admin_contact.phone.value | string | ||
| action_result.data.*.admin_contact.postal.value | string | ||
| action_result.data.*.admin_contact.state.value | string | ||
| action_result.data.*.admin_contact.street.value | string | ||
| action_result.data.*.adsense.value | string | ||
| action_result.data.*.alexa | numeric | ||
| action_result.data.*.billing_contact.city.value | string | ||
| action_result.data.*.billing_contact.country.value | string | ||
| action_result.data.*.billing_contact.fax.value | string | ||
| action_result.data.*.billing_contact.name.value | string | ||
| action_result.data.*.billing_contact.org.value | string | ||
| action_result.data.*.billing_contact.phone.value | string | ||
| action_result.data.*.billing_contact.postal.value | string | ||
| action_result.data.*.billing_contact.state.value | string | ||
| action_result.data.*.billing_contact.street.value | string | ||
| action_result.data.*.create_date.value | string | ||
| action_result.data.*.domain_risk.risk_score | numeric | ||
| action_result.data.*.email_domain.*.value | string | ||
| action_result.data.*.expiration_date.value | string | ||
| action_result.data.*.first_seen.value | string | ||
| action_result.data.*.google_analytics.value | string | ||
| action_result.data.*.ip.*.address.value | string | ||
| action_result.data.*.ip.*.asn.*.value | string | ||
| action_result.data.*.ip.*.country_code.value | string | ||
| action_result.data.*.ip.*.isp.value | string | ||
| action_result.data.*.mx.*.domain.value | string | ||
| action_result.data.*.mx.*.host.value | string | ||
| action_result.data.*.mx.*.ip.*.value | string | ||
| action_result.data.*.name_server.*.domain.value | string | ||
| action_result.data.*.name_server.*.host.value | string | ||
| action_result.data.*.name_server.*.ip.*.value | string | ||
| action_result.data.*.redirect.value | string | ||
| action_result.data.*.redirect_domain.value | string | ||
| action_result.data.*.registrant_contact.city.value | string | ||
| action_result.data.*.registrant_contact.country.value | string | ||
| action_result.data.*.registrant_contact.email.*.value | string | ||
| action_result.data.*.registrant_contact.fax.value | string | ||
| action_result.data.*.registrant_contact.name.value | string | ||
| action_result.data.*.registrant_contact.org.value | string | ||
| action_result.data.*.registrant_contact.phone.value | string | ||
| action_result.data.*.registrant_contact.postal.value | string | ||
| action_result.data.*.registrant_contact.state.value | string | ||
| action_result.data.*.registrant_contact.street.value | string | ||
| action_result.data.*.registrant_name.value | string | ||
| action_result.data.*.registrant_org.value | string | ||
| action_result.data.*.registrar.value | string | ||
| action_result.data.*.server_type.value | string | ||
| action_result.data.*.soa_email.*.value | string | ||
| action_result.data.*.ssl_info.*.alt_names.*.value | string | ||
| action_result.data.*.ssl_info.*.common_name.value | string | ||
| action_result.data.*.ssl_info.*.duration.value | string | ||
| action_result.data.*.ssl_info.*.email.*.value | string | ||
| action_result.data.*.ssl_info.*.hash.value | string | ||
| action_result.data.*.ssl_info.*.issuer_common_name.value | string | ||
| action_result.data.*.ssl_info.*.not_after.value | string | ||
| action_result.data.*.ssl_info.*.not_before.value | string | ||
| action_result.data.*.ssl_info.*.organization.value | string | ||
| action_result.data.*.ssl_info.*.subject.value | string | ||
| action_result.data.*.tags.*.label | string | ||
| action_result.data.*.tags.*.scope | string | ||
| action_result.data.*.tags.*.tagged_at | string | ||
| action_result.data.*.technical_contact.city.value | string | ||
| action_result.data.*.technical_contact.country.value | string | ||
| action_result.data.*.technical_contact.fax.value | string | ||
| action_result.data.*.technical_contact.name.value | string | ||
| action_result.data.*.technical_contact.org.value | string | ||
| action_result.data.*.technical_contact.phone.value | string | ||
| action_result.data.*.technical_contact.postal.value | string | ||
| action_result.data.*.technical_contact.state.value | string | ||
| action_result.data.*.technical_contact.street.value | string | ||
| action_result.data.*.tld | string | ||
| action_result.data.*.website_title.value | string | ||
| action_result.summary | string | ||
| action_result.message | string | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
Run on initial setup to configure the optional monitoring playbooks. This action creates a custom list to manage the playbook scheduling and run status
Type: investigate
Read only: True
No parameters are required for this action
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.status | string | failed success | |
| action_result.data.* | string | ||
| action_result.summary | string | ||
| action_result.message | string | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
Execute scheduled playbooks based on the set interval(mins) in 'domaintools_scheduled_playbooks' custom list. Smaller intervals will result in more accurate schedules
Type: ingest
Read only: True
No parameters are required for this action
No Output
The Parsed Domain RDAP API returns the most recent Domain-RDAP registration record in response to a HTTP GET query. This API compliments the Parsed Whois API as some registries and registrar are beginning to support RDAP as an alternative to Whois for providing domain registration data
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| domain | optional | The domain name to query (e.g., example.com) | string |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.data | string | ||
| action_result.data.*.domain | string | domain | |
| action_result.data.*.domain_statuses | string | ||
| action_result.data.*.creation_date | string | ||
| action_result.data.*.last_changed_date | string | ||
| action_result.data.*.expiration_date | string | ||
| action_result.data.*.dnssec.signed | boolean | ||
| action_result.data.*.nameservers | string | ||
| action_result.data.*.conformance | string | ||
| action_result.data.*.emails | string | ||
| action_result.data.*.email_domains | string | ||
| action_result.data.*.unclassified_emails | string | ||
| action_result.data.*.registrar_name | string | ||
| action_result.data.*.registrar_iana_id | string | ||
| action_result.data.*.registrar_contacts_name | string | ||
| action_result.data.*.registrar_contacts_email | string | ||
| action_result.data.*.registrar_contacts_phone | string | ||
| action_result.data.*.registrar_contacts_roles | string | ||
| action_result.data.*.contact_name_1 | string | ||
| action_result.data.*.contact_org_1 | string | ||
| action_result.data.*.contact_email_1 | string | ||
| action_result.data.*.contact_phone_1 | string | ||
| action_result.data.*.contact_street_1 | string | ||
| action_result.data.*.contact_city_1 | string | ||
| action_result.data.*.contact_postal_1 | string | ||
| action_result.data.*.contact_region_1 | string | ||
| action_result.data.*.contact_country_1 | string | ||
| action_result.data.*.contact_roles_1 | string | ||
| action_result.data.*.contact_name_2 | string | ||
| action_result.data.*.contact_org_2 | string | ||
| action_result.data.*.contact_email_2 | string | ||
| action_result.data.*.contact_phone_2 | string | ||
| action_result.data.*.contact_street_2 | string | ||
| action_result.data.*.contact_city_2 | string | ||
| action_result.data.*.contact_postal_2 | string | ||
| action_result.data.*.contact_region_2 | string | ||
| action_result.data.*.contact_country_2 | string | ||
| action_result.data.*.contact_roles_2 | string | ||
| action_result.data.*.contact_name_3 | string | ||
| action_result.data.*.contact_org_3 | string | ||
| action_result.data.*.contact_email_3 | string | ||
| action_result.data.*.contact_phone_3 | string | ||
| action_result.data.*.contact_street_3 | string | ||
| action_result.data.*.contact_city_3 | string | ||
| action_result.data.*.contact_postal_3 | string | ||
| action_result.data.*.contact_region_3 | string | ||
| action_result.data.*.contact_country_3 | string | ||
| action_result.data.*.contact_roles_3 | string | ||
| action_result.status | string | success failed | |
| action_result.summary | string | ||
| action_result.message | string | ||
| action_result.parameter.domain | string | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
Apex-level domains (e.g. example.com but not www.example.com) observed for the first time by the DomainTools sensor network, and which are not present in our DNSDB historical database
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| domain | optional | Filter for an exact domain or a substring contained within a domain by prefixing or suffixing your substring with '*'. Check the documentation for examples | string | |
| before | optional | The end of the query window in seconds or in ISO8601 format, relative to the current time, inclusive. | string | |
| after | optional | Filter for records before the given time value inclusive or time offset relative to now. | string | |
| session_id | optional | A custom string to distinguish between different sessions | string | |
| top | optional | Limit the number of results to the top N, where N is the value of this parameter | string |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.data | string | ||
| action_result.data.*.domain | string | domain | |
| action_result.data.*.timestamp | string | ||
| action_result.status | string | success failed | |
| action_result.summary | string | ||
| action_result.message | string | ||
| action_result.parameter.after | string | ||
| action_result.parameter.before | string | ||
| action_result.parameter.domain | string | ||
| action_result.parameter.session_id | string | ||
| action_result.parameter.top | string | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
Apex-level domains (e.g. example.com but not www.example.com) DomainTools has newly observed in our DNS sensor network. This includes domains observed in DNS for the first time as well as domains observed in DNS again after not being observed for at least 10 days
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| domain | optional | Filter for an exact domain or a substring contained within a domain by prefixing or suffixing your substring with '*'. Check the documentation for examples | string | |
| before | optional | The end of the query window in seconds or in ISO8601 format, relative to the current time, inclusive. | string | |
| after | optional | Filter for records before the given time value inclusive or time offset relative to now. | string | |
| session_id | optional | A custom string to distinguish between different sessions | string | |
| top | optional | Limit the number of results to the top N, where N is the value of this parameter | string |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.data | string | ||
| action_result.data.*.domain | string | domain | |
| action_result.data.*.timestamp | string | ||
| action_result.status | string | success failed | |
| action_result.summary | string | ||
| action_result.message | string | ||
| action_result.parameter.after | string | ||
| action_result.parameter.before | string | ||
| action_result.parameter.domain | string | ||
| action_result.parameter.session_id | string | ||
| action_result.parameter.top | string | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
Contains fully qualified domain names (i.e. host names) that have never been seen before in passive DNS, emitted as soon as they are first observed. Hostname resolutions that we observe for the first time with our global DNS sensor network
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| domain | optional | Used to filter feed results. The filter can be an exact match or a partial match when the * character is included at the beginning and/or end of the value | string | |
| before | optional | The end of the query window in seconds or in ISO8601 format, relative to the current time, inclusive. | string | |
| after | optional | The start of the query window in seconds in ISO8601 format, relative to the current time, inclusive. | string | |
| session_id | optional | Serves as a unique identifier for the session. This parameter ensures that data retrieval begins from the latest timestamp recorded in the previous data pull. | string | |
| top | optional | The number of results to return in the response payload. Primarily used for testing. | string |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.data | string | ||
| action_result.data.*.domain | string | domain | |
| action_result.data.*.timestamp | string | ||
| action_result.status | string | success failed | |
| action_result.summary | string | ||
| action_result.message | string | ||
| action_result.parameter.after | string | ||
| action_result.parameter.before | string | ||
| action_result.parameter.domain | string | ||
| action_result.parameter.session_id | string | ||
| action_result.parameter.top | string | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
New domains as they are either discovered in domain registration information, observed by our global sensor network, or reported by trusted third parties
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| domain | optional | Used to filter feed results. The filter can be an exact match or a partial match when the * character is included at the beginning and/or end of the value. | string | |
| before | optional | The end of the query window in seconds or in ISO8601 format, relative to the current time, inclusive. | string | |
| after | optional | The start of the query window in seconds in ISO8601 format, relative to the current time, inclusive. | string | |
| session_id | optional | Serves as a unique identifier for the session. This parameter ensures that data retrieval begins from the latest timestamp recorded in the previous data pull. | string | |
| top | optional | The number of results to return in the response payload. Primarily used for testing. | string |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.data | string | ||
| action_result.data.*.domain | string | domain | |
| action_result.data.*.timestamp | string | ||
| action_result.status | string | success failed | |
| action_result.summary | string | ||
| action_result.message | string | ||
| action_result.parameter.after | string | ||
| action_result.parameter.before | string | ||
| action_result.parameter.domain | string | ||
| action_result.parameter.session_id | string | ||
| action_result.parameter.top | string | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
List of records for a given domain may be provided by a domain registry, registrar, or both. Domain registries maintain authoritative information about one or more top-level domains (e.g., .com), while domain registrars manage apex domains (e.g., domaintools.com). When domain information is present from both the registry and registrar, this API presents a record containing both sets of results, as well the original raw JSON record, from both the registry and registrar
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| domain | optional | Used to filter feed results. The filter can be an exact match or a partial match when the * character is included at the beginning and/or end of the value. | string | |
| before | optional | The end of the query window in seconds or in ISO8601 format, relative to the current time, inclusive. | string | |
| after | optional | The start of the query window in seconds in ISO8601 format, relative to the current time, inclusive. | string | |
| session_id | optional | Serves as a unique identifier for the session. This parameter ensures that data retrieval begins from the latest timestamp recorded in the previous data pull. | string | |
| top | optional | The number of results to return in the response payload. Primarily used for testing. | string |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.data | string | ||
| action_result.data.*.domain | string | domain | |
| action_result.data.*.timestamp | string | ||
| action_result.data.*.parsed_record.parsed_fields | string | ||
| action_result.status | string | success failed | |
| action_result.summary | string | ||
| action_result.message | string | ||
| action_result.parameter.after | string | ||
| action_result.parameter.before | string | ||
| action_result.parameter.domain | string | ||
| action_result.parameter.session_id | string | ||
| action_result.parameter.top | string | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
Real-time updates to Domain Risk Scores for apex domains, regardless of observed traffic
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| domain | optional | Used to filter feed results. The filter can be an exact match or a partial match when the * character is included at the beginning and/or end of the value. | string | |
| before | optional | The end of the query window in seconds or in ISO8601 format, relative to the current time, inclusive. | string | |
| after | optional | The start of the query window in seconds in ISO8601 format, relative to the current time, inclusive. | string | |
| session_id | optional | Serves as a unique identifier for the session. This parameter ensures that data retrieval begins from the latest timestamp recorded in the previous data pull. | string | |
| top | optional | The number of results to return in the response payload. Primarily used for testing. | string |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.data | string | ||
| action_result.data.*.domain | string | domain | |
| action_result.data.*.timestamp | string | ||
| action_result.data.*.phishing_risk | string | ||
| action_result.data.*.malware_risk | string | ||
| action_result.data.*.spam_risk | string | ||
| action_result.data.*.proximity_risk | string | ||
| action_result.data.*.overall_risk | string | ||
| action_result.status | string | success failed | |
| action_result.summary | string | ||
| action_result.message | string | ||
| action_result.parameter.after | string | ||
| action_result.parameter.before | string | ||
| action_result.parameter.domain | string | ||
| action_result.parameter.session_id | string | ||
| action_result.parameter.top | string | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
Domains with high Domain Risk Scores that have also been active within 24 hours
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| domain | optional | Used to filter feed results. The filter can be an exact match or a partial match when the * character is included at the beginning and/or end of the value. | string | |
| before | optional | The end of the query window in seconds or in ISO8601 format, relative to the current time, inclusive. | string | |
| after | optional | The start of the query window in seconds in ISO8601 format, relative to the current time, inclusive. | string | |
| session_id | optional | Serves as a unique identifier for the session. This parameter ensures that data retrieval begins from the latest timestamp recorded in the previous data pull. | string | |
| top | optional | The number of results to return in the response payload. Primarily used for testing. | string |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.data | string | ||
| action_result.data.*.domain | string | domain | |
| action_result.data.*.timestamp | string | ||
| action_result.data.*.phishing_risk | string | ||
| action_result.data.*.malware_risk | string | ||
| action_result.data.*.spam_risk | string | ||
| action_result.data.*.proximity_risk | string | ||
| action_result.data.*.overall_risk | string | ||
| action_result.data.*.expires | string | ||
| action_result.status | string | success failed | |
| action_result.summary | string | ||
| action_result.message | string | ||
| action_result.parameter.after | string | ||
| action_result.parameter.before | string | ||
| action_result.parameter.domain | string | ||
| action_result.parameter.session_id | string | ||
| action_result.parameter.top | string | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
Retrieve newly discovered domains from Iris Detect across all monitors or a specific monitor
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| monitor_id | optional | Monitor ID to filter results to a specific monitor | string | |
| tlds | optional | Comma-separated list of TLDs to filter results (e.g. com,net) | string | |
| risk_score_ranges | optional | Comma-separated risk score ranges to filter by (e.g. 70-99,100-100) | string | |
| mx_exists | optional | Filter by whether the domain has an MX record | boolean | |
| discovered_since | optional | Filter domains discovered since this datetime (ISO 8601 format) | string | |
| changed_since | optional | Filter domains changed since this datetime (ISO 8601 format) | string | |
| search | optional | Search string to filter domains by name (contains match) | string | |
| sort | optional | Sort field (discovered_date, changed_date, or risk_score) | string | |
| order | optional | Sort order | string | |
| include_domain_data | optional | Include DNS and WHOIS/RDAP details in the response | boolean | |
| limit | optional | Maximum number of results to return (max 100, or 50 if include_domain_data is true) | numeric | |
| offset | optional | Number of results to skip for pagination | numeric | |
| preview | optional | Preview mode for testing — limits results to 10 without hourly rate limit | boolean |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.data.*.domain | string | domain | |
| action_result.data.*.state | string | ||
| action_result.data.*.risk_score | numeric | ||
| action_result.data.*.risk_score_status | string | ||
| action_result.data.*.discovered_date | string | ||
| action_result.data.*.changed_date | string | ||
| action_result.data.*.status | string | ||
| action_result.data.*.tld | string | ||
| action_result.data.*.id | string | ||
| action_result.data.*.mx_exists | boolean | ||
| action_result.data.*.monitor_ids | string | ||
| action_result.status | string | success failed | |
| action_result.message | string | ||
| action_result.summary.domain_count | numeric | ||
| action_result.summary.total_count | numeric | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 | |
| action_result.parameter.monitor_id | string | ||
| action_result.parameter.tlds | string | ||
| action_result.parameter.risk_score_ranges | string | ||
| action_result.parameter.mx_exists | boolean | ||
| action_result.parameter.discovered_since | string | ||
| action_result.parameter.changed_since | string | ||
| action_result.parameter.search | string | ||
| action_result.parameter.sort | string | ||
| action_result.parameter.order | string | ||
| action_result.parameter.include_domain_data | boolean | ||
| action_result.parameter.limit | numeric | ||
| action_result.parameter.preview | boolean | ||
| action_result.parameter.offset | numeric |
Retrieve watched domains from Iris Detect across all monitors or a specific monitor
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| monitor_id | optional | Monitor ID to filter results to a specific monitor | string | |
| tlds | optional | Comma-separated list of TLDs to filter results (e.g. com,net) | string | |
| risk_score_ranges | optional | Comma-separated risk score ranges to filter by (e.g. 70-99,100-100) | string | |
| mx_exists | optional | Filter by whether the domain has an MX record | boolean | |
| discovered_since | optional | Filter domains discovered since this datetime (ISO 8601 format) | string | |
| changed_since | optional | Filter domains changed since this datetime (ISO 8601 format) | string | |
| escalated_since | optional | Filter domains escalated since this datetime (ISO 8601 format) | string | |
| search | optional | Search string to filter domains by name (contains match) | string | |
| sort | optional | Sort field | string | |
| order | optional | Sort order | string | |
| include_domain_data | optional | Include DNS and WHOIS/RDAP details in the response | boolean | |
| limit | optional | Maximum number of results to return (max 100, or 50 if include_domain_data is true) | numeric | |
| offset | optional | Number of results to skip for pagination | numeric | |
| preview | optional | Preview mode for testing — limits results to 10 without hourly rate limit | boolean |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.data.*.domain | string | domain | |
| action_result.data.*.state | string | ||
| action_result.data.*.risk_score | numeric | ||
| action_result.data.*.risk_score_status | string | ||
| action_result.data.*.discovered_date | string | ||
| action_result.data.*.changed_date | string | ||
| action_result.data.*.status | string | ||
| action_result.data.*.escalations | string | ||
| action_result.data.*.tld | string | ||
| action_result.data.*.id | string | ||
| action_result.data.*.mx_exists | boolean | ||
| action_result.data.*.monitor_ids | string | ||
| action_result.status | string | success failed | |
| action_result.message | string | ||
| action_result.summary.domain_count | numeric | ||
| action_result.summary.total_count | numeric | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 | |
| action_result.parameter.monitor_id | string | ||
| action_result.parameter.tlds | string | ||
| action_result.parameter.risk_score_ranges | string | ||
| action_result.parameter.mx_exists | boolean | ||
| action_result.parameter.discovered_since | string | ||
| action_result.parameter.changed_since | string | ||
| action_result.parameter.escalated_since | string | ||
| action_result.parameter.search | string | ||
| action_result.parameter.sort | string | ||
| action_result.parameter.order | string | ||
| action_result.parameter.include_domain_data | boolean | ||
| action_result.parameter.limit | numeric | ||
| action_result.parameter.preview | boolean | ||
| action_result.parameter.offset | numeric |
Retrieve ignored (false positive) domains from Iris Detect across all monitors or a specific monitor
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| monitor_id | optional | Monitor ID to filter results to a specific monitor | string | |
| tlds | optional | Comma-separated list of TLDs to filter results (e.g. com,net) | string | |
| risk_score_ranges | optional | Comma-separated risk score ranges to filter by (e.g. 70-99,100-100) | string | |
| mx_exists | optional | Filter by whether the domain has an MX record | boolean | |
| discovered_since | optional | Filter domains discovered since this datetime (ISO 8601 format) | string | |
| changed_since | optional | Filter domains changed since this datetime (ISO 8601 format) | string | |
| escalated_since | optional | Filter domains escalated since this datetime (ISO 8601 format) | string | |
| search | optional | Search string to filter domains by name (contains match) | string | |
| sort | optional | Sort field | string | |
| order | optional | Sort order | string | |
| include_domain_data | optional | Include DNS and WHOIS/RDAP details in the response | boolean | |
| limit | optional | Maximum number of results to return (max 100, or 50 if include_domain_data is true) | numeric | |
| offset | optional | Number of results to skip for pagination | numeric | |
| preview | optional | Preview mode for testing — limits results to 10 without hourly rate limit | boolean |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.data.*.domain | string | domain | |
| action_result.data.*.state | string | ||
| action_result.data.*.risk_score | numeric | ||
| action_result.data.*.risk_score_status | string | ||
| action_result.data.*.discovered_date | string | ||
| action_result.data.*.changed_date | string | ||
| action_result.data.*.status | string | ||
| action_result.data.*.tld | string | ||
| action_result.data.*.id | string | ||
| action_result.data.*.mx_exists | boolean | ||
| action_result.data.*.monitor_ids | string | ||
| action_result.status | string | success failed | |
| action_result.message | string | ||
| action_result.summary.domain_count | numeric | ||
| action_result.summary.total_count | numeric | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 | |
| action_result.parameter.monitor_id | string | ||
| action_result.parameter.tlds | string | ||
| action_result.parameter.risk_score_ranges | string | ||
| action_result.parameter.mx_exists | boolean | ||
| action_result.parameter.discovered_since | string | ||
| action_result.parameter.changed_since | string | ||
| action_result.parameter.escalated_since | string | ||
| action_result.parameter.search | string | ||
| action_result.parameter.sort | string | ||
| action_result.parameter.order | string | ||
| action_result.parameter.include_domain_data | boolean | ||
| action_result.parameter.limit | numeric | ||
| action_result.parameter.preview | boolean | ||
| action_result.parameter.offset | numeric |
Retrieve domains escalated to Google Safe Browsing from Iris Detect
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| monitor_id | optional | Monitor ID to filter results to a specific monitor | string | |
| tlds | optional | Comma-separated list of TLDs to filter results (e.g. com,net) | string | |
| risk_score_ranges | optional | Comma-separated risk score ranges to filter by (e.g. 70-99,100-100) | string | |
| mx_exists | optional | Filter by whether the domain has an MX record | boolean | |
| discovered_since | optional | Filter domains discovered since this datetime (ISO 8601 format) | string | |
| changed_since | optional | Filter domains changed since this datetime (ISO 8601 format) | string | |
| escalated_since | optional | Filter domains escalated since this datetime (ISO 8601 format) | string | |
| search | optional | Search string to filter domains by name (contains match) | string | |
| sort | optional | Sort field | string | |
| order | optional | Sort order | string | |
| include_domain_data | optional | Include DNS and WHOIS/RDAP details in the response | boolean | |
| limit | optional | Maximum number of results to return (max 100, or 50 if include_domain_data is true) | numeric | |
| offset | optional | Number of results to skip for pagination | numeric | |
| preview | optional | Preview mode for testing — limits results to 10 without hourly rate limit | boolean |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.data.*.domain | string | domain | |
| action_result.data.*.state | string | ||
| action_result.data.*.risk_score | numeric | ||
| action_result.data.*.risk_score_status | string | ||
| action_result.data.*.discovered_date | string | ||
| action_result.data.*.changed_date | string | ||
| action_result.data.*.status | string | ||
| action_result.data.*.escalations | string | ||
| action_result.data.*.tld | string | ||
| action_result.data.*.id | string | ||
| action_result.data.*.mx_exists | boolean | ||
| action_result.data.*.monitor_ids | string | ||
| action_result.status | string | success failed | |
| action_result.message | string | ||
| action_result.summary.domain_count | numeric | ||
| action_result.summary.total_count | numeric | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 | |
| action_result.parameter.monitor_id | string | ||
| action_result.parameter.tlds | string | ||
| action_result.parameter.risk_score_ranges | string | ||
| action_result.parameter.mx_exists | boolean | ||
| action_result.parameter.discovered_since | string | ||
| action_result.parameter.changed_since | string | ||
| action_result.parameter.escalated_since | string | ||
| action_result.parameter.search | string | ||
| action_result.parameter.sort | string | ||
| action_result.parameter.order | string | ||
| action_result.parameter.include_domain_data | boolean | ||
| action_result.parameter.limit | numeric | ||
| action_result.parameter.preview | boolean | ||
| action_result.parameter.offset | numeric |
Retrieve domains escalated for internal blocking from Iris Detect
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| monitor_id | optional | Monitor ID to filter results to a specific monitor | string | |
| tlds | optional | Comma-separated list of TLDs to filter results (e.g. com,net) | string | |
| risk_score_ranges | optional | Comma-separated risk score ranges to filter by (e.g. 70-99,100-100) | string | |
| mx_exists | optional | Filter by whether the domain has an MX record | boolean | |
| discovered_since | optional | Filter domains discovered since this datetime (ISO 8601 format) | string | |
| changed_since | optional | Filter domains changed since this datetime (ISO 8601 format) | string | |
| escalated_since | optional | Filter domains escalated since this datetime (ISO 8601 format) | string | |
| search | optional | Search string to filter domains by name (contains match) | string | |
| sort | optional | Sort field | string | |
| order | optional | Sort order | string | |
| include_domain_data | optional | Include DNS and WHOIS/RDAP details in the response | boolean | |
| limit | optional | Maximum number of results to return (max 100, or 50 if include_domain_data is true) | numeric | |
| offset | optional | Number of results to skip for pagination | numeric | |
| preview | optional | Preview mode for testing — limits results to 10 without hourly rate limit | boolean |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.data.*.domain | string | domain | |
| action_result.data.*.state | string | ||
| action_result.data.*.risk_score | numeric | ||
| action_result.data.*.risk_score_status | string | ||
| action_result.data.*.discovered_date | string | ||
| action_result.data.*.changed_date | string | ||
| action_result.data.*.status | string | ||
| action_result.data.*.escalations | string | ||
| action_result.data.*.tld | string | ||
| action_result.data.*.id | string | ||
| action_result.data.*.mx_exists | boolean | ||
| action_result.data.*.monitor_ids | string | ||
| action_result.status | string | success failed | |
| action_result.message | string | ||
| action_result.summary.domain_count | numeric | ||
| action_result.summary.total_count | numeric | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 | |
| action_result.parameter.monitor_id | string | ||
| action_result.parameter.tlds | string | ||
| action_result.parameter.risk_score_ranges | string | ||
| action_result.parameter.mx_exists | boolean | ||
| action_result.parameter.discovered_since | string | ||
| action_result.parameter.changed_since | string | ||
| action_result.parameter.escalated_since | string | ||
| action_result.parameter.search | string | ||
| action_result.parameter.sort | string | ||
| action_result.parameter.order | string | ||
| action_result.parameter.include_domain_data | boolean | ||
| action_result.parameter.limit | numeric | ||
| action_result.parameter.preview | boolean | ||
| action_result.parameter.offset | numeric |
Retrieve the list of monitors configured in Iris Detect for your account
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| include_counts | optional | Include counts of new, watched, changed, and escalated domains per monitor | boolean | |
| datetime_counts_since | optional | Required if include_counts is true. Datetime to count domains from (ISO 8601 format) | string | |
| sort | optional | Sort field | string | |
| order | optional | Sort order | string | |
| limit | optional | Maximum number of monitors to return (max 100) | numeric | |
| offset | optional | Number of results to skip for pagination | numeric |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.data.*.term | string | ||
| action_result.data.*.id | string | ||
| action_result.data.*.state | string | ||
| action_result.data.*.status | string | ||
| action_result.data.*.created_date | string | ||
| action_result.data.*.updated_date | string | ||
| action_result.data.*.created_by | string | ||
| action_result.data.*.match_substring_variations | boolean | ||
| action_result.data.*.nameserver_exclusions | string | ||
| action_result.data.*.text_exclusions | string | ||
| action_result.data.*.domain_counts.new | numeric | ||
| action_result.data.*.domain_counts.watched | numeric | ||
| action_result.data.*.domain_counts.changed | numeric | ||
| action_result.data.*.domain_counts.escalated | numeric | ||
| action_result.status | string | success failed | |
| action_result.message | string | ||
| action_result.summary.monitor_count | numeric | ||
| action_result.summary.total_count | numeric | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 | |
| action_result.parameter.include_counts | boolean | ||
| action_result.parameter.datetime_counts_since | string | ||
| action_result.parameter.sort | string | ||
| action_result.parameter.order | string | ||
| action_result.parameter.limit | numeric | ||
| action_result.parameter.offset | numeric |
Escalate one or more watched domains to Google Safe Browsing via Iris Detect
Type: correct
Read only: False
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| watchlist_domain_ids | required | Comma-separated list of Iris Detect domain IDs to escalate to Google Safe Browsing | string |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.data.*.watchlist_domain_id | string | ||
| action_result.data.*.escalation_type | string | ||
| action_result.data.*.id | string | ||
| action_result.data.*.created_date | string | ||
| action_result.data.*.created_by | string | ||
| action_result.data.*.updated_date | string | ||
| action_result.parameter.watchlist_domain_ids | string | ||
| action_result.status | string | success failed | |
| action_result.message | string | ||
| action_result.summary.escalated_count | numeric | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
Escalate one or more watched domains for internal blocking via Iris Detect
Type: correct
Read only: False
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| watchlist_domain_ids | required | Comma-separated list of Iris Detect domain IDs to escalate for internal blocking | string |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.data.*.watchlist_domain_id | string | ||
| action_result.data.*.escalation_type | string | ||
| action_result.data.*.id | string | ||
| action_result.data.*.created_date | string | ||
| action_result.data.*.created_by | string | ||
| action_result.data.*.updated_date | string | ||
| action_result.parameter.watchlist_domain_ids | string | ||
| action_result.status | string | success failed | |
| action_result.message | string | ||
| action_result.summary.blocklisted_count | numeric | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
Add one or more domains to the Iris Detect watchlist for ongoing monitoring
Type: correct
Read only: False
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| watchlist_domain_ids | required | Comma-separated list of Iris Detect domain IDs to add to the watchlist | string |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.data.*.domain | string | domain | |
| action_result.data.*.state | string | ||
| action_result.data.*.id | string | ||
| action_result.data.*.discovered_date | string | ||
| action_result.data.*.changed_date | string | ||
| action_result.parameter.watchlist_domain_ids | string | ||
| action_result.status | string | success failed | |
| action_result.message | string | ||
| action_result.summary.watched_count | numeric | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
Mark one or more domains as ignored (false positives) in Iris Detect
Type: correct
Read only: False
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| watchlist_domain_ids | required | Comma-separated list of Iris Detect domain IDs to mark as ignored | string |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.data.*.domain | string | domain | |
| action_result.data.*.state | string | ||
| action_result.data.*.id | string | ||
| action_result.data.*.discovered_date | string | ||
| action_result.data.*.changed_date | string | ||
| action_result.parameter.watchlist_domain_ids | string | ||
| action_result.status | string | success failed | |
| action_result.message | string | ||
| action_result.summary.ignored_count | numeric | ||
| summary.total_objects | numeric | 1 | |
| summary.total_objects_successful | numeric | 1 |
Auto-generated Splunk SOAR Connector documentation.
Copyright 2026 Splunk Inc.
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.