DomainTools Feed v1.2.0: Ingest IP threat feeds in Cortex XSOAR

← All updates · September 23, 2026

Added

• IP threat feed ingestion: DomainTools Feed for Cortex XSOAR adds iphotlist and iprisk feed types for IP Hotlist API and IP Risk API intelligence. Existing instances configured with Feed Type=ALL begin ingesting IP indicators after upgrading to version 1.2.0. To retrieve filtered IP feed records manually, use domaintools-get-indicators; set create_indicators=true to add the returned data as indicators with DomainTools reputation data, a DBotScore, and IP-specific fields for investigation and threat hunting.

Documentation

• Cortex XSOAR integration guide
• Cortex XSOAR documentation
• IP Risk API
• IP Hotlist API

Categories: Integrations, Cortex XSOAR