Skip to content
DomainTools Technical Documentation

DomainTools App for Splunk v5.8: IP Threat Feed searches

← All updates ·

Added

  • IP Threat Feed searches: The DomainTools App for Splunk now includes dtfeediphotlist and dtfeediprisk. Use them to investigate high-risk hosting IP addresses and broader IP risk context with filters for threat activity, hosting density, ownership, and geography.
  • Scheduled indexing: Save an IP feed search as a Splunk report to write new results to an event index on a schedule. Use a persistent sessionID so each scheduled run continues from the prior request.

Changed

  • Threat Feed query controls: Existing feed commands now support time-window, session, and result-limit options that align with Threat Feeds.

Fixed

  • IP feed validation: The app now prevents incompatible IP feed session options.
  • Splunk compatibility: This release corrects text overlap on the Iris Investigate Domain Profile page and improves Splunk AppInspect validation.

Documentation

Categories: Integrations, Splunk