Skip to content
DomainTools Technical Documentation

Cortex XSOAR — command, pivot link, and verdict scoring fixes

← All updates ·

Fixed

  • bypass_auto_enrich not honored on domaintoolsiris-investigate — When auto-enrichment was disabled at the instance level, passing bypass_auto_enrich="true" to the domaintoolsiris-investigate command was ignored. The parameter now overrides the instance default.

  • War room pivot links failing — IP, SSL email, and website title pivot links generated in the Cortex XSOAR war room produced malformed URLs from incorrect character escaping. Links now resolve correctly in Iris Investigate.

  • Slow dbot verdict scoring — The domain command saved the full Iris Investigate payload to XSOAR context, delaying the dbot verdict (benign, suspicious, or malicious) on indicators. Context writes are now optimized to reduce the delay.

  • domaintools-whois command error — Running !domaintools-whois query=<IP> debug-mode=true threw an error. The command now runs correctly with debug mode enabled.

Documentation

Categories: Integrations, Cortex XSOAR