DomainTools App for Splunk v5.0: Major enhancements and new alerts

← All updates · July 2, 2024

Changed

Enrich history population: Enrichment history is now populated during the normal enrichment process
Monitored enrichment history: Enrichment history is populated during the monitored enrichment process
New Iris fields in enrichment: New Iris fields are populated during the enrichment process
New Iris fields in domain profile: New Iris fields are displayed in the domain profile
Pivotable Iris fields: New Iris fields are now pivotable for enhanced investigation workflows

Alert for increased risk score: New alert triggers when domain risk score increases
Alert for risk score threshold: New alert triggers when risk score increases and exceeds a specified threshold
Alert for Detect domains: New alert for domains identified by Iris Detect
ES-specific alerts: Alerts generated specifically for Enterprise Security environments
Non-ES alerts: Alerts generated for non-Enterprise Security environments
Universal alerts: Alerts that work in both ES and non-ES environments

Alert display in dashboards: Fixed issue where alerts for both ES and non-ES environments are now shown correctly in dashboards