DomainToolsIrisDetect

DomainTools is an essential component in the security stack of mature enterprises and performance-driven security teams.

Category

Data Enrichment & Threat Intelligence

Pack

DomainToolsIrisDetect

Configuration parameters

• credentials — DomainTools API Username (required)
• new_domains — Enabled on New Domains
• changed_domains — Enabled on Changed Domains
• blocked_domains — Enabled on Blocked Domains
• risk_score_ranges — Risk score Ranges
• include_domain_data — Include Domain Data
• first_fetch — First fetch timestamp (example 7 days)
• max_fetch — Maximum number of incidents to fetch
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• incidentFetchInterval — Incidents Fetch Interval
• incidentType — Incident type
• isFetch — Fetch incidents

Commands (11)

• domaintools-iris-detect-blocklist-domains — Mark a given domain as blocked, which allows a script against the Iris Detect API to pass these domains on to other teams or security controls within your organization to block them in email, web, or other filtering controls.
• domaintools-iris-detect-escalate-domains — Reports a domain to Google's Safe Browsing API. After approval, their block list is picked up by Chrome and most modern browsers.
• domaintools-iris-detect-get-blocklist-domains — Manually retrieve domains that your organization has marked as "blocklisted", matching all of your monitored terms, or a specific term specified by a "monitor_id" that can be retrieved using the domaintools-iris-detect-get-monitors-list command. The number of domains returned is limited to 50 if including DNS and whois details, or 100 otherwise. Use the page and page_size parameter for pagination. Use the page and page_size parameter for pagination.
• domaintools-iris-detect-get-escalated-domains — Manually retrieve domains that your organization has escalated to Google Safe Browsing, matching all of your monitored terms, or a specific term specified by a "monitor_id" that can be retrieved using the domaintools-iris-detect-get-monitors-list command. The number of domains returned is limited to 50 if including DNS and whois details, or 100 otherwise. Use the page and page_size parameter for pagination.
• domaintools-iris-detect-get-ignored-domains — Manually retrieve domains that your organization has marked as ignored, matching all of your monitored terms, or a specific term specified by a "monitor_id" that can be retrieved using the domaintools-iris-detect-get-monitors-list command. This is most useful in cases when a domain might have been mistakenly ignored. The number of domains returned is limited to 50 if including DNS and whois details, or 100 otherwise. Use the page and page_size parameter for pagination.
• domaintools-iris-detect-get-monitors-list — This command allows users to retrieve the list of monitored terms and respective IDs associated with your organization's Iris Detect account. New terms can only be set up and configured directly within the Iris Detect UI (https://iris.domaintools.com/detect/). The results are limited to 100 monitors if include_counts is True, or 500 otherwise.
• domaintools-iris-detect-get-new-domains — Manually retrieve new domains matching all of your monitored terms, or a specific term specified by a "monitor_id" that can be retrieved using the domaintools-iris-detect-get-monitors-list command. The number of domains returned is limited to 50 if including DNS and whois details, or 100 otherwise. Use the page and page_size parameter for pagination.
• domaintools-iris-detect-get-watched-domains — Manually retrieve changes to domains that have been marked as "watched" by users of your organization, matching all of your monitored terms, or a specific term specified by a "monitor_id" that can be retrieved using the domaintools-iris-detect-get-monitors-list command. The number of domains returned is limited to 50 if including DNS and whois details, or 100 otherwise. Use the page and page_size parameter for pagination.
• domaintools-iris-detect-ignore-domains — Ignore a given domain, removing it from new and block lists, if applicable.
• domaintools-iris-detect-reset-fetch-indicators — This command will reset your fetch history.
• domaintools-iris-detect-watch-domains — Mark a given domain as watched, which will trigger more frequent scanning by DomainTools automation. Changes to watched domains can trigger incidents if enabled, or manually queried via the domaintools-iris-detect-get-watched-domains command.