DomainTools App for Splunk v5.5: Real-time feed support

← All updates · August 15, 2025

Added

• Newly Observed Hostnames (NOH) feed: Ingest the real-time stream of hostnames first observed in passive DNS using the dt_feed_noh index.
• Real-time Risk feed: Ingest the continuously updated feed of domains with a risk score of 70 or higher using the dt_feed_domainrisk index.
• Domain Hotlist feed: Ingest the real-time feed of active high-risk domains — those with passive DNS activity in the last 24 hours — using the dt_feed_domainhotlist index.

See Enable feeds for feed setup and index configuration.

Fixed

• Iris Detect escalated domains: Resolved inconsistent results for escalated domains in Iris Detect queries.

Documentation

• DomainTools App for Splunk release notes
• Splunk integration overview
• Enable Threat Feeds

Categories: Integrations, Splunk