DomainTools Iris Investigate v2.2.10

Facilitates automation of key infrastructure characterization and hunting portions of the incident response process. Organizations will have access to essential domain profile, web crawl, SSL, and infrastructure data from within Cortex XSOAR. Requires a DomainTools Iris Investigate API key.

Author:
DomainTools
Support:
partner
URL:
https://www.domaintools.com/support/
agentixxsiam
Data Enrichment & Threat Intelligence

Classifiers (2)

Incident types (2)

Indicator fields (13)

  • DomainTools Iris Additional Whois Emails
  • DomainTools Iris Domain Age
  • DomainTools Iris Email Domains
  • DomainTools Iris Expiration Date
  • DomainTools Iris First Seen
  • DomainTools Iris IP Addresses
  • DomainTools Iris IP Country Code
  • DomainTools Iris Mail Servers
  • DomainTools Iris Registrant Org
  • DomainTools Iris Risk Score
  • DomainTools Iris Risk Score Components
  • DomainTools Iris SOA Email
  • DomainTools Iris Tags

Indicator types (1)

  • reputations-Domaintools_Iris

Integrations (1)

Layouts (2)

Playbooks (1)

Scripts (8)

README

Together, DomainTools and Cortex XSOAR automate and orchestrate the incident response processes with essential domain profile, web crawl, SSL, and infrastructure data delivered by the DomainTools Iris Investigate API. SOCs can create custom, automated workflows to trigger Indicator of Compromise (IoC) investigations, block threats based on connected infrastructure, and identify potentially malicious incidents before weaponization.

What does this pack do?

With the DomainTools Iris App for Cortex XSOAR, the Iris dataset is available not only for ad-hoc War-Room investigations on specific incidents, but also for automated actions. Organizations will be able to fetch a complete Iris profile for a domain name including:

  • IP address and hostname details for the name servers, mail servers, and web servers powering the domain.
  • SSL certificate details and tracking codes for the website hosted on the domain.
  • Gathers email addresses extracted from DNS SOA records.
  • Provides DomainTools Risk Score with components and evidence.

This app requires an Iris Investigate API key. Please contact sales@domaintools.com for a trial.

For more information, visit DomainTools Iris App for Cortex XSOAR