Indicator Pivoting - DomainTools Iris

Pivots are used to gather data that share a common attribute with a domain. For instance, pivoting on an IP Address will give you back all domains related to that IP address.

DomainTools Iris Investigate · 17 tasks · 13 inputs · 86 outputs

Inputs

  • IPAddress — The IP address to pivot.
  • EmailAddress — The Email address for which to pivot.
  • NameServerIPAddress — The Name Server IP address for which to pivot.
  • SSLHash — The SSL Hash for which to pivot.
  • NameServerHostName — The Name Server Host Name for which to pivot.
  • MailServerHostName — The Mail Server Host Name for which to pivot.
  • IPAddressCount — The number of matches for the IP address.
  • EmailAddressCount — The number of matches for the Email address.
  • NameServerIPAddressCount — The number of matches for the Name Server IP address.
  • SSLHashCount — The number of matches for the SSL Hash.
  • NameServerHostNameCount — The number of matches for the Name Server Host Name.
  • MailServerHostNameCount — The number of matches for the Mail Server Host Name.
  • PivotThreshold — The threshold for matches less than to pivot on.

Outputs

  • DomainTools.PivotedDomains.Name — The DomainTools Domain Name.
  • DomainTools.PivotedDomains.LastEnriched — The last time DomainTools enriched domain data.
  • DomainTools.PivotedDomains.Analytics.OverallRiskScore — The DomainTools Overall Risk Score.
  • DomainTools.PivotedDomains.Analytics.ProximityRiskScore — The DomainTools Proximity Risk Score.
  • DomainTools.PivotedDomains.Analytics.ThreatProfileRiskScore.RiskScore — The DomainTools Threat Profile Risk Score.
  • DomainTools.PivotedDomains.Analytics.ThreatProfileRiskScore.Threats — The DomainTools Threat Profile Threats.
  • DomainTools.PivotedDomains.Analytics.ThreatProfileRiskScore.Evidence — The DomainTools Threat Profile Evidence.
  • DomainTools.PivotedDomains.Analytics.WebsiteResponseCode — The Website Response Code.
  • DomainTools.PivotedDomains.Analytics.AlexaRank — The Alexa Rank.
  • DomainTools.PivotedDomains.Analytics.Tags — The DomainTools Tags.
  • DomainTools.PivotedDomains.Identity.RegistrantName — The name of the registrant.
  • DomainTools.PivotedDomains.Identity.RegistrantOrg — The organization of the registrant.
  • DomainTools.PivotedDomains.Identity.RegistrantContact.Country.value — The country value of the registrant contact.
  • DomainTools.PivotedDomains.Identity.RegistrantContact.Country.count — The Country count of the registrant contact.
  • DomainTools.PivotedDomains.Identity.RegistrantContact.Email.value — The Email value of the registrant contact.
  • DomainTools.PivotedDomains.Identity.RegistrantContact.Email.count — The Email count of the registrant contact.
  • DomainTools.PivotedDomains.Identity.RegistrantContact.Name.value — The name value of the registrant contact.
  • DomainTools.PivotedDomains.Identity.RegistrantContact.Name.count — The name count of the registrant contact.
  • DomainTools.PivotedDomains.Identity.RegistrantContact.Phone.value — The phone value of the registrant contact.
  • DomainTools.PivotedDomains.Identity.RegistrantContact.Phone.count — The phone count of the registrant contact.
  • DomainTools.PivotedDomains.Identity.SOAEmail — The SOA record Email.
  • DomainTools.PivotedDomains.Identity.SSLCertificateEmail — The SSL certificate Email.
  • DomainTools.PivotedDomains.Identity.AdminContact.Country.value — The country value of the administrator contact.
  • DomainTools.PivotedDomains.Identity.AdminContact.Country.count — The country count of the administrator contact.
  • DomainTools.PivotedDomains.Identity.AdminContact.Email.value — The Email value of the administrator contact.
  • DomainTools.PivotedDomains.Identity.AdminContact.Email.count — The Email count of the administrator contact.
  • DomainTools.PivotedDomains.Identity.AdminContact.Name.value — The name value of the administrator contact.
  • DomainTools.PivotedDomains.Identity.AdminContact.Name.count — The name count of the administrator contact.
  • DomainTools.PivotedDomains.Identity.AdminContact.Phone.value — The phone value of the administrator contact.
  • DomainTools.PivotedDomains.Identity.AdminContact.Phone.count — The phone count of the administrator contact.
  • DomainTools.PivotedDomains.Identity.TechnicalContact.Country.value — The country value of the technical contact.
  • DomainTools.PivotedDomains.Identity.TechnicalContact.Country.count — The country count of the technical contact.
  • DomainTools.PivotedDomains.Identity.TechnicalContact.Email.value — The Email value of the technical contact.
  • DomainTools.PivotedDomains.Identity.TechnicalContact.Email.count — The Email count of the technical contact.
  • DomainTools.PivotedDomains.Identity.TechnicalContact.Name.value — The name value of the technical contact.
  • DomainTools.PivotedDomains.Identity.TechnicalContact.Name.count — The name count of the technical contact.
  • DomainTools.PivotedDomains.Identity.TechnicalContact.Phone.value — The phone value of the technical contact.
  • DomainTools.PivotedDomains.Identity.TechnicalContact.Phone.count — The phone count of the technical contact.
  • DomainTools.PivotedDomains.Identity.BillingContact.Country.value — The country value of the billing contact.
  • DomainTools.PivotedDomains.Identity.BillingContact.Country.count — The country count of the billing contact.
  • DomainTools.PivotedDomains.Identity.BillingContact.Email.value — The Email value of the billing contact.
  • DomainTools.PivotedDomains.Identity.BillingContact.Email.count — The Email count of the billing contact.
  • DomainTools.PivotedDomains.Identity.BillingContact.Name.value — The name value of the billing contact.
  • DomainTools.PivotedDomains.Identity.BillingContact.Name.count — The name count of the billing contact.
  • DomainTools.PivotedDomains.Identity.BillingContact.Phone.value — The phone value of the billing contact.
  • DomainTools.PivotedDomains.Identity.BillingContact.Phone.count — The phone count of the billing contact.
  • DomainTools.PivotedDomains.Identity.EmailDomains — The Email domains.
  • DomainTools.PivotedDomains.Identity.AdditionalWhoisEmails.value — The value of the Additional Whois Emails.
  • DomainTools.PivotedDomains.Identity.AdditionalWhoisEmails.count — The count of the Additional Whois Emails.
  • DomainTools.PivotedDomains.Registration.DomainRegistrant — The registrant of the domain.
  • DomainTools.PivotedDomains.Registration.RegistrarStatus — The status of the registrar.
  • DomainTools.PivotedDomains.Registration.DomainStatus — The active status of the domain.
  • DomainTools.PivotedDomains.Registration.CreateDate — The date the domain was created.
  • DomainTools.PivotedDomains.Registration.ExpirationDate — The expiry date of the domain.
  • DomainTools.PivotedDomains.Hosting.IPAddresses.address.value — The address value of the IP Addresses.
  • DomainTools.PivotedDomains.Hosting.IPAddresses.address.count — The address count of the IP Addresses.
  • DomainTools.PivotedDomains.Hosting.IPAddresses.asn.value — The ASN value of the IP Addresses.
  • DomainTools.PivotedDomains.Hosting.IPAddresses.asn.count — The ASN count of the IP Addresses.
  • DomainTools.PivotedDomains.Hosting.IPAddresses.country_code.value — The country code value of the IP Addresses.
  • DomainTools.PivotedDomains.Hosting.IPAddresses.country_code.count — The country code count of the IP Addresses.
  • DomainTools.PivotedDomains.Hosting.IPAddresses.isp.value — The ISP value of the IP Addresses.
  • DomainTools.PivotedDomains.Hosting.IPAddresses.isp.count — The ISP count of the IP Addresses.
  • DomainTools.PivotedDomains.Hosting.IPCountryCode — The country code of the IP address.
  • DomainTools.PivotedDomains.Hosting.MailServers.domain.value — The domain value of the Mail Servers.
  • DomainTools.PivotedDomains.Hosting.MailServers.domain.count — The domain count of the Mail Servers.
  • DomainTools.PivotedDomains.Hosting.MailServers.host.value — The host value of the Mail Servers.
  • DomainTools.PivotedDomains.Hosting.MailServers.host.count — The host count of the Mail Servers.
  • DomainTools.PivotedDomains.Hosting.MailServers.ip.value — The IP value of the Mail Servers.
  • DomainTools.PivotedDomains.Hosting.MailServers.ip.count — The IP count of the Mail Servers.
  • DomainTools.PivotedDomains.Hosting.SPFRecord — The SPF record.
  • DomainTools.PivotedDomains.Hosting.NameServers.domain.value — The domain value of the DomainTools Domains NameServers.
  • DomainTools.PivotedDomains.Hosting.NameServers.domain.count — The domain count of the DomainTools Domains NameServers.
  • DomainTools.PivotedDomains.Hosting.NameServers.host.value — The host value of the DomainTools Domains NameServers.
  • DomainTools.PivotedDomains.Hosting.NameServers.host.count — The host count of the DomainTools Domains NameServers.
  • DomainTools.PivotedDomains.Hosting.NameServers.ip.value — The IP value of the DomainTools Domains NameServers.
  • DomainTools.PivotedDomains.Hosting.NameServers.ip.count — The IP count of the DomainTools Domains NameServers.
  • DomainTools.PivotedDomains.Hosting.SSLCertificate.hash.value — The Hash value of the SSL certificate.
  • DomainTools.PivotedDomains.Hosting.SSLCertificate.hash.count — The Hash count of the SSL certificate.
  • DomainTools.PivotedDomains.Hosting.SSLCertificate.organization.value — The organization value of the SSL certificate.
  • DomainTools.PivotedDomains.Hosting.SSLCertificate.organization.count — The organization count of the SSL certificate.
  • DomainTools.PivotedDomains.Hosting.SSLCertificate.subject.value — The subject value of the SSL certificate.
  • DomainTools.PivotedDomains.Hosting.SSLCertificate.subject.count — The subject count of the SSL certificate.
  • DomainTools.PivotedDomains.Hosting.RedirectsTo.value — The Redirects To value of the domain.
  • DomainTools.PivotedDomains.Hosting.RedirectsTo.count — The Redirects To count of the domain.
  • DomainTools.PivotedDomains.Analytics.GoogleAdsenseTrackingCode — The tracking code of Google Adsense.
  • DomainTools.PivotedDomains.Analytics.GoogleAnalyticTrackingCode — The tracking code of Google Analytics.

Commands used

domaintoolsiris-pivot

Flowchart

email_address ip nameserver_ip ssl_hash nameserver_host mailserver_host yes Start Start Done Done Pivot on E-mail address? Pivot on E-mail address? E-mail Pivot - domaintoolsiris-pivot E-mail Pivot domaintoolsiris-pivot IP Pivot - domaintoolsiris-pivot IP Pivot domaintoolsiris-pivot NameServer IP Pivot - domaintoolsiris-pivot NameServer IP Pivot domaintoolsiris-pivot SSL Hash Pivot - domaintoolsiris-pivot SSL Hash Pivot domaintoolsiris-pivot NameServer HostName Pivot - domaintoolsiris-pivot NameServer HostName Pivot domaintoolsiris-pivot MailServer HostName - domaintoolsiris-pivot MailServer HostName domaintoolsiris-pivot Pivot on an IP address? Pivot on an IP address? Pivot on a NameServer IP? Pivot on a NameServer IP? Pivot on a SSL Hash? Pivot on a SSL Hash? Pivot on NameServer HostName? Pivot on NameServer HostN... Pivot on a MailServer HostName? Pivot on a MailServer Hos... Is DomainTools Iris enabled? Is DomainTools Iris enabled? Indicator Pivoting Indicator Pivoting Integration Not Enabled Integration Not Enabled