DomainTools Product Updates

DomainTools App for Splunk v5.8: IP Threat Feed searches

Thu, 03 Sep 2026 00:00:00 +0000

Added

IP Threat Feed searches: The DomainTools App for Splunk now includes dtfeediphotlist and dtfeediprisk. Use them to investigate high-risk hosting IP addresses and broader IP risk context with filters for threat activity, hosting density, ownership, and geography.
Scheduled indexing: Save an IP feed search as a Splunk report to write new results to an event index on a schedule. Use a persistent sessionID so each scheduled run continues from the prior request.

Changed

Threat Feed query controls: Existing feed commands now support time-window, session, and result-limit options that align with Threat Feeds.

Fixed

IP feed validation: The app now prevents incompatible IP feed session options.
Splunk compatibility: This release corrects text overlap on the Iris Investigate Domain Profile page and improves Splunk AppInspect validation.

Documentation

DomainTools App for Splunk v5.7: IrisQL search support

Fri, 31 Jul 2026 00:00:00 +0000

Added

IrisQL searches: The DomainTools App for Splunk now supports IrisQL, the text-based query language for Iris Investigate, through the dtirisinvestigate custom search command. Start each query with # IrisQL-1.0, use it in standard Splunk Search Processing Language (SPL), then pipe the results to later commands.

Documentation

DomainTools Python SDK v2.9: Query IP Threat Feeds

Wed, 29 Jul 2026 00:00:00 +0000

Added

IP feed methods (v2.9.0): Query the IP Hotlist and IP Risk feeds from the DomainTools Python SDK with iphotlist() and iprisk(). Use the same feed-session controls and response options available through the Threat Feeds API.

Fixed

Iris Enrich recovery (v2.8.1): Iris Enrich calls can proceed when a temporary service response prevents the SDK from completing its rate-limit check.
Feed result limits (v2.9.0): The top option for Feeds methods is now correctly typed as an integer.

Documentation

DomainTools Feeds Integration for Elastic v1.6.0: header-based authentication

Mon, 20 Jul 2026 00:00:00 +0000

Changed

Header-based authentication: The integration now sends your DomainTools API credentials in a request header rather than in the URL query string. Configure your API username and key in the integration settings as before; no change to the credentials themselves is required.

Documentation

Filter Iris Detect domains by First Seen date

Mon, 20 Jul 2026 00:00:00 +0000

Added

First Seen date range filter — Filter a monitor's domains to those first seen within a start and end date. The filter applies across all domain-state tabs (New, Watched, Changed, Inactive, Escalated, Ignored) and works with "All Monitors" selected. It always evaluates each domain's First Seen date, regardless of the tab's default Sort By column.

Documentation

Filter and sort domains

DomainTools App for Splunk v5.6.1 through v5.6.3

Wed, 01 Jul 2026 00:00:00 +0000

Added

Splunk Cloud 10.x support, including Cloud 10.2 with Enterprise Security (v5.6.1): The app runs on Python 3.13 and is supported on Splunk Cloud Platform 10.x, including Cloud 10.2 running Enterprise Security (ES).

Changed

Offline public suffix list (v5.6.2): The app ships with a bundled public suffix list and no longer downloads an updated list at runtime. Environments that restrict outbound connections no longer break on domain extraction. You can update the bundled list manually if needed.
Iris Investigate (API only) SKU support (v5.6.2): The Test Connection and Iris Investigate dashboards now recognize the Iris Investigate (API only) SKU, so accounts on that entitlement no longer see incorrect "no access" messages for Domain Profile and pivoting features.

Fixed

Iris Detect imports on large ignore lists (v5.6.3): Scheduled Iris Detect result imports no longer hang or exceed the hourly rate limit for accounts with large numbers of ignored domains. The import now fetches only recently changed ignored domains rather than the full history.

Documentation

MCP Server distinguishes WHOIS and RDAP registration data

Tue, 23 Jun 2026 00:00:00 +0000

Changed

Registration data attributed to WHOIS or RDAP: The MCP Server explicitly describes registration fields (registrar, registrant, contacts, and registration dates) as registration data drawn from a single source, WHOIS or RDAP, selected per domain by recency and completeness. Agents will be better able to attribute each field to the protocol that produced it, and to explain which source was used and why.

Documentation

DomainTools Python SDK: v2.3—v2.8

Tue, 16 Jun 2026 00:00:00 +0000

Added

IrisQL in iris_investigate (v2.8.0): Pass IrisQL queries through the SDK's iris_investigate interface to build structured domain searches with logical operators and field-level filters, instead of assembling parameter dictionaries by hand.
Domain History method (v2.8.0): A new domain_history method retrieves timestamped registration records through the Domain History API.
Real-Time Threat Feeds (v2.5.0, v2.6.0): Support for the Domain Risk and Domain Hotlist feeds, and streaming requests for Real-Time Threat Feed endpoints so you can consume large feeds incrementally.
Newly Observed Hostnames feed (v2.4.0): The Newly Observed Hostnames feed is now callable through the SDK.

Changed

Header authentication for Iris endpoints (v2.5.3): Iris API calls can authenticate with the X-Api-Key header instead of query-string credentials.
Iris Investigate API parity (v2.7.0): Parameter and response handling brought in line with the current Iris Investigate API, with improved validation and error handling.

Fixed

risk_score filter dropped in iris_investigate (v2.7.3): The risk_score parameter wasn't forwarded, so filtered queries returned the full result set; it is now passed through.
ValidationError on None-value arguments (v2.7.4): Passing None for an optional iris_investigate argument (common when forwarding **kwargs) raised an error instead of being ignored; None values are now ignored.
XML response handling (v2.8.0): Responses requested in xml format are now parsed correctly.

Documentation

Manage group API accounts from the Group Admin page

Thu, 11 Jun 2026 00:00:00 +0000

Added

Account list and usage: View every API account in the group, with per-product usage, capacity, and quota reset dates on one page.
Key reset: Rotate any account's API key from its detail view. The old key stops working immediately and the owner isn't emailed — update integrations before you reset.
Deactivation: Deactivate an API account so its key stops working and it drops off the list.
CSV export: Download the group's API usage as a comma-separated values (CSV) file; the export reflects the current filter and sort.

Documentation

Manage group API accounts
Group management
Account Information API to check a single account programmatically
Storing credentials

Real-time IP Risk and IP Hotlist feeds now available

Tue, 19 May 2026 00:00:00 +0000

Added

Real-time IP Risk Feed — Continuously updated feed of high-risk IP addresses hosting domains, scored across threat type, geolocation, and ASN. Designed for integration into TIPs, SIEMs, and data lakes to enrich blocking and detection workflows with current IP risk context.
Real-time IP Hotlist Feed — A curated subset of the IP Risk Feed containing only the highest-risk IPs: those where more than 50% of hosted domains are high-risk and show passive DNS activity. Suitable for high-confidence blocking and alerting use cases.

Both feeds are available alongside the existing domain-based Real-time Threat Feeds (Domain Risk, Domain Hotlist, Newly Observed Domains, Newly Observed Hostnames, Newly Active Domains, and Domain Discovery).

Documentation

MCP Server — DNSDB Passive DNS, Domain History, and OAuth support

Mon, 18 May 2026 00:00:00 +0000

Added

DNSDB passive DNS tools — New tools expose passive DNS data from DNSDB directly through the MCP Server. Agents can run forward and inverse passive DNS lookups, time-fenced queries, and pattern-based searches to trace historical DNS resolution, identify infrastructure pivots, and surface related domains observed across the global DNS infrastructure.
Domain registration history tools — New tools surface domain registration history via the Domain History API. Agents can retrieve timestamped WHOIS and registration records — including registrar changes, contact updates, and infrastructure transitions — as part of investigation workflows.
OAuth 2.0 authentication — The MCP Server now supports OAuth with pre-registered client credentials, so MCP clients sign in with a DomainTools account instead of an API key. OAuth pre-registration is available for the following clients:
- Claude Code — fixed callback port
- Claude Desktop — Custom Connector with Advanced settings
- Cursor — .cursor/mcp.json auth block
- Gemini CLI — ~/.gemini/settings.json with static redirect URI
- VS Code — Command Palette MCP Add, GitHub Copilot agent mode
To request OAuth credentials, contact your DomainTools representative or email enterprisesupport@domaintools.com with your chosen client(s), redirect URIs, and an optional proposed client name. DomainTools returns a confirmed client name, client ID, and client secret.

:::note[Client name match]

Except for VS Code, the name you use in your MCP client configuration must exactly match the client name registered with DomainTools. The server rejects connections where the name doesn't match.
:::
Clients that don't support OAuth pre-registration — such as Codex and Goose Desktop — continue to use API key authentication.

Documentation

FeedDomainTools Pack v1.0.7 for Cortex XSOAR: Risk score detail in feed indicators

Sun, 10 May 2026 00:00:00 +0000

Changed

Risk score details in rawJSON for feed indicators — The rawJSON payload for domainrisk and domainhotlist feed indicators now includes the full risk score breakdown:
- Overall score
- Component scores (proximity, phishing, malware, spam)
- Threat type classifications

Analysts can see the complete risk context directly in the XSOAR indicator table and war room without an additional lookup.

Documentation

IrisQL tool in the MCP Server

Wed, 06 May 2026 00:00:00 +0000

Added

The new irisql MCP tool lets AI clients run Iris Investigate searches written in IrisQL, extending the MCP Server's search capabilities alongside the existing structured pivot tools:

Expressive query syntax: OR logic across field values, nested AND/OR combinations, field presence checks, and relative date ranges (for example, "created in the last 30 days"). All queries must begin with the version comment # IrisQL-1.0.
Pagination: position cursor, matching the lookup_bulk response shape
Built-in syntax guidance: The server exposes the IrisQL reference as an MCP resource at docs://irisql-reference, which conversational clients load automatically before constructing queries

Documentation

IrisQL available in the Iris Investigate API

Mon, 04 May 2026 00:00:00 +0000

Added

You can now send IrisQL queries to the Iris Investigate API:

Logical operators: Combine conditions with AND, OR, and NOT to express complex search logic in a single query.
Field-level filters: Target specific domain attributes — registration data, infrastructure, risk scores, and more — using named field syntax.
Shareable queries: IrisQL is plain text. Queries pass directly in API calls, paste into tickets, and reproduce consistently across tools and sessions.
UI and MCP parity: The same queries that run in Advanced Search and the irisql MCP tool work unmodified against the API endpoint.

All IrisQL queries must begin with the version comment # IrisQL-1.0.

Documentation

DomainTools integration for Google SecOps SOAR v11.0

Thu, 23 Apr 2026 00:00:00 +0000

Added

Iris Investigate Enrichment: Run a domain through DomainTools Iris Investigate from a playbook; returns a comprehensive domain profile including connected infrastructure, related domains, and risk indicators.
Whois History: Surface historical WHOIS records to track ownership and registration changes over time.
Parsed RDAP Lookups: Pull structured RDAP registration data for any domain.
Connectivity Validation: Health check that validates DomainTools API credentials and confirms the integration is configured correctly.

Documentation

Google SecOps SOAR integration overview
DomainTools — Google SecOps SOAR Marketplace — Google's setup and configuration documentation

Cortex XSOAR — command, pivot link, and verdict scoring fixes

Thu, 09 Apr 2026 00:00:00 +0000

Fixed

bypass_auto_enrich not honored on domaintoolsiris-investigate — When auto-enrichment was disabled at the instance level, passing bypass_auto_enrich="true" to the domaintoolsiris-investigate command was ignored. The parameter now overrides the instance default.
War room pivot links failing — IP, SSL email, and website title pivot links generated in the Cortex XSOAR war room produced malformed URLs from incorrect character escaping. Links now resolve correctly in Iris Investigate.
Slow dbot verdict scoring — The domain command saved the full Iris Investigate payload to XSOAR context, delaying the dbot verdict (benign, suspicious, or malicious) on indicators. Context writes are now optimized to reduce the delay.
domaintools-whois command error — Running !domaintools-whois query=<IP> debug-mode=true threw an error. The command now runs correctly with debug mode enabled.

Documentation

Anomali integration v1.1.0: RDAP enrichment and DNSDB passive DNS panel

Tue, 31 Mar 2026 00:00:00 +0000

Added

Parsed RDAP data in Iris Investigate enrichment: The Iris Investigate domain enrichment panel now includes structured RDAP registration data — registrar, registrant organization, contact email, creation and expiration dates, and abuse contact information — retrieved directly from the Parsed RDAP API.
DNSDB passive DNS enrichment panel: A new DNSDB tab is available in the enrichment panel for domain observables. The panel displays historical and near-real-time passive DNS records from Farsight DNSDB, including DNS resolution history, infrastructure changes, and related domains observed across the global DNS infrastructure. Requires an active DNSDB subscription.

Documentation

Connect your AI client to DomainTools threat intelligence with the MCP Server

Tue, 31 Mar 2026 00:00:00 +0000

Added

The DomainTools MCP Server enables LLM applications to access domain threat intelligence through the Model Context Protocol. DomainTools hosts the server. Connect using your own MCP-compatible client such as Claude Code CLI, VS Code with GitHub Copilot, Cline, or Gemini CLI.

The server provides 15 tools across three product areas:

Iris Investigate: Domain lookups, risk scoring, and pivot searches across shared infrastructure, registration, and web properties
Farsight DNSDB: Forward and inverse passive DNS lookups with pattern-based search
Domain History: Timestamped registration, infrastructure, and website change records

For an investigation walkthrough and SOC integration use cases, see the announcement blog post.

Documentation

Cortex XSOAR Iris pack: new domain enrichment controls

Tue, 03 Mar 2026 00:00:00 +0000

Added

Domain Result Type (v2.2.6): The domain command takes a result-type setting that controls what it returns. iris returns full Iris Investigate results; verdict returns only the domain risk score, for faster indicator triage.
Domain Enrichment Method (v2.2.7): Choose which DomainTools method enriches domains. Defaults to Iris Investigate.
Domain Auto-Enrich on Ingestion (v2.2.7): Enable automatic enrichment of domains as they are ingested, so incoming indicators arrive already enriched. Automatic enrichment consumes Iris API queries; leave it off if you want to control query volume manually.

Documentation

Create, update, and delete monitors via the Iris Detect API

Tue, 03 Mar 2026 00:00:00 +0000

Added

Three new operations are available on the /v1/iris-detect/monitors/ endpoint:

Create: Add a new monitor with a term and optional exclusions.
Update: Modify exclusions on an existing monitor.
Delete: Permanently remove a monitor.

All three operations require the manage monitors permission.