Skip to content
DomainTools Technical Documentation

DomainTools App for Splunk v5.4: Feeds expansion and Parsed RDAP

← All updates ·

Added

  • Domain Discovery feed: Ingest the Domain Discovery feed into Splunk to surface newly discovered domains in your environment. See Enable feeds for setup.
  • Domain RDAP feed: Ingest the Parsed Domain RDAP feed for a real-time stream of registration data.
  • Parsed Domain RDAP API: New parseddrdap investigation action returns structured parsed RDAP records for a domain directly in Splunk.

Changed

  • Complete results for large queries: Large queries now return the full dataset instead of timing out, by following 206 partial-content responses across multiple API calls. See the feed data retrieval guide for how 206 responses work.
  • Proxy support (5.4.1): Added socks5 and socks5h proxy support, including remote DNS resolution.
  • Private TLD handling (5.4.1): Private domains are now treated as TLDs, improving domain extraction accuracy.
  • Recent Events dashboard (5.4.1): The Recent Events table is now its own dashboard.

Fixed

  • Setup logging: The setup logger now runs only when explicitly enabled, reducing log noise.
  • Domain extraction logging (5.4.1): domainextract logging is now off by default.

Documentation

Categories: Integrations, Splunk