Skip to content
DomainTools Technical Documentation

Security Information Exchange (SIE) APIs

Download PDF

Farsight SIE gives you real-time access to data from a global sensor network, including over half a million passive DNS observations per second alongside other security data points. DomainTools processes this data into usable formats, streams it over real-time channels, and provides tools for retrieving it.

Access methods

Section titled “Access methods”

SIE channels are available through three mechanisms, each suited to a different workflow:

  • SIE Batch: A web interface and REST API with access to the last 12-18 hours of data from your subscribed feeds. Start here if you want to pull recent data on demand without maintaining a live connection.
  • SIE Remote Access: A tunnel from SIE to your system with a REST API (AXAMD), for continuous real-time streaming.
  • SIE Direct Connect: A leased blade server with pre-installed SIE tools for direct access to the network. See the SIE User Guide for provisioning and system requirements.

Data formats

Section titled “Data formats”

Feeds are typically available in NMSG and JSON. NMSG is a streaming binary format for high-volume real-time traffic; the included nmsgtool converts it to JSON. Some feeds provide JSON (JSONL/NDJSON) directly. See the SIE User Guide for details.

Get started

Section titled “Get started”

Access to SIE is provisioned by DomainTools Enterprise Support at enterprisesupport@domaintools.com. Batch and Remote Access use an API key; Direct Connect requires your public key and originating IP addresses.