Microsoft Sentinel adds DomainTools Threat Feeds connector

← All updates · September 3, 2026

Added

• Threat Feed ingestion: The DomainTools Threat Feeds connector for Microsoft Sentinel ingests Newly Observed Domains, Newly Active Domains, Newly Observed Hostnames, and Domain Discovery records into a Microsoft Sentinel custom log. Security teams can use the records for investigation, hunting, dashboards, and analytics.
• Sentinel content: The DomainTools CCF solution includes the DomainToolsThreatIntelDomains parser, the DomainTools Threat Intelligence Dashboard workbook, and four analytics rule templates. Review and tune the templates for your environment before relying on them for incident creation.

Documentation

• Connect DomainTools Threat Feeds to Microsoft Sentinel
• View the DomainTools Threat Intelligence listing in Microsoft Marketplace
• Compare DomainTools Threat Feeds

Categories: Integrations, Microsoft Sentinel, Threat Feeds