DomainToolsIrisDetect

DomainTools is an essential component in the security stack of mature enterprises and performance-driven security teams.

Data Enrichment & Threat Intelligence · DomainTools Iris Detect

Configuration parameters

  • credentials — DomainTools API Username (required)
  • new_domains — Enabled on New Domains
  • changed_domains — Enabled on Changed Domains
  • blocked_domains — Enabled on Blocked Domains
  • risk_score_ranges — Risk score Ranges
  • include_domain_data — Include Domain Data
  • first_fetch — First fetch timestamp (example 7 days)
  • max_fetch — Maximum number of incidents to fetch
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentFetchInterval — Incidents Fetch Interval
  • incidentType — Incident type
  • isFetch — Fetch incidents

Commands (11)

  • domaintools-iris-detect-blocklist-domains

    Mark a given domain as blocked, which allows a script against the Iris Detect API to pass these domains on to other teams or security controls within your organization to block them in email, web, or other filtering controls.

  • domaintools-iris-detect-escalate-domains

    Reports a domain to Google's Safe Browsing API. After approval, their block list is picked up by Chrome and most modern browsers.

  • domaintools-iris-detect-get-blocklist-domains

    Manually retrieve domains that your organization has marked as "blocklisted", matching all of your monitored terms, or a specific term specified by a "monitor_id" that can be retrieved using the domaintools-iris-detect-get-monitors-list command. The number of domains returned is limited to 50 if including DNS and whois details, or 100 otherwise. Use the page and page_size parameter for pagination. Use the page and page_size parameter for pagination.

  • domaintools-iris-detect-get-escalated-domains

    Manually retrieve domains that your organization has escalated to Google Safe Browsing, matching all of your monitored terms, or a specific term specified by a "monitor_id" that can be retrieved using the domaintools-iris-detect-get-monitors-list command. The number of domains returned is limited to 50 if including DNS and whois details, or 100 otherwise. Use the page and page_size parameter for pagination.

  • domaintools-iris-detect-get-ignored-domains

    Manually retrieve domains that your organization has marked as ignored, matching all of your monitored terms, or a specific term specified by a "monitor_id" that can be retrieved using the domaintools-iris-detect-get-monitors-list command. This is most useful in cases when a domain might have been mistakenly ignored. The number of domains returned is limited to 50 if including DNS and whois details, or 100 otherwise. Use the page and page_size parameter for pagination.

  • domaintools-iris-detect-get-monitors-list

    This command allows users to retrieve the list of monitored terms and respective IDs associated with your organization's Iris Detect account. New terms can only be set up and configured directly within the Iris Detect UI (https://iris.domaintools.com/detect/). The results are limited to 100 monitors if include_counts is True, or 500 otherwise.

  • domaintools-iris-detect-get-new-domains

    Manually retrieve new domains matching all of your monitored terms, or a specific term specified by a "monitor_id" that can be retrieved using the domaintools-iris-detect-get-monitors-list command. The number of domains returned is limited to 50 if including DNS and whois details, or 100 otherwise. Use the page and page_size parameter for pagination.

  • domaintools-iris-detect-get-watched-domains

    Manually retrieve changes to domains that have been marked as "watched" by users of your organization, matching all of your monitored terms, or a specific term specified by a "monitor_id" that can be retrieved using the domaintools-iris-detect-get-monitors-list command. The number of domains returned is limited to 50 if including DNS and whois details, or 100 otherwise. Use the page and page_size parameter for pagination.

  • domaintools-iris-detect-ignore-domains

    Ignore a given domain, removing it from new and block lists, if applicable.

  • domaintools-iris-detect-reset-fetch-indicators

    This command will reset your fetch history.

  • domaintools-iris-detect-watch-domains

    Mark a given domain as watched, which will trigger more frequent scanning by DomainTools automation. Changes to watched domains can trigger incidents if enabled, or manually queried via the domaintools-iris-detect-get-watched-domains command.