Palo Alto XSOAR: DomainTools app

Use the DomainTools Iris app to bring Domain Name System (DNS) intelligence into Palo Alto XSOAR. You can enrich malicious domain observables in incidents and automate response workflows.

For more information about XSOAR, see the official Palo Alto XSOAR documentation. For playbooks, see the DomainTools GitHub repository.

Key capabilities

Use the Iris Investigate API in Palo Alto XSOAR to enrich domain observables and investigate them in incident context.

The app enables:

• Ad hoc investigations of domain Indicators of Compromise (IOCs) inside Palo Alto XSOAR incidents
• Triage with DomainTools Risk Score, Threat Profile Scores, and other actionable analytics
• Persistent DomainTools intelligence inside Palo Alto XSOAR
• Discovery of connected infrastructure for a malicious domain
• Automated triaging of DomainTools Iris tags inside Palo Alto XSOAR
• Automated enrichment process using DomainTools playbooks
• Targeted threat hunting at key aspects of a domain name’s registration profile

Before you begin

You need:

• Palo Alto XSOAR Server 6.6.0 or later
• Palo Alto XSOAR Content version 1.32.44 (6877054) or later
• Active DomainTools Iris Investigate API credentials (username and key)

Set up the Iris integration

DomainTools offers two integrations: DomainTools Iris Investigate (as DomainTools Iris), and the DomainTools Real-time Threat Feeds (as FeedDomainTools). This guide provides instructions for both integrations, which you configure independently.

Install and configure Iris Investigate

1. Select Settings > Integrations > Servers & Services
2. Search for “DomainTools” to find the DomainTools Iris (Partner Contribution) integration
3. Select Add Instance to configure the DomainTools instance
4. Enter the configuration parameters described in the following table:

Parameter name	Required	Description
API Username	Yes	Username used to authenticate DomainTools API calls.
API Key	Yes	API key used to authenticate DomainTools API calls.
High-Risk Threshold	Yes	A configurable threshold for DomainTools Risk Score that flags risky domains within your Palo Alto XSOAR instance. Default is 70.
Young Domain Timeframe	Yes	A configurable threshold (in days) used to calculate if a domain is considered a ‘young domain’ within Palo Alto XSOAR.
Guided Pivot Threshold	Yes	Guided pivots are data points where 500 or fewer domains (by default) have that exact same value for the data point. You can configure the exact threshold number as desired.
Fetch Incidents	Yes	Determines if the system enables the fetching of incidents (monitoring of Iris hash and Iris tag).
Classifier	No	Determines the classifier to use when incidents are fetched or created. Classifies the incident type. You can choose DomainTools_Iris_Classifier. Required if Fetch Incidents is enabled.
Incident Type	No	Determines what type of incident to create. Should default to “N/A” because there are two types of incidents. The classifiers handle this.
Mapper	No	Determines the mapper to use when incidents are fetched or created. Maps the result with a given key to the created incident. Currently maps the domain key from Iris result to Additional Indicators incident field. You can choose DomainTools_Iris_Mapper. Required if Fetch Incidents is enabled.
Enabled on Monitoring Domains by Iris Hash	No	Determines what method to use. Options are Import Indicators Only and Create Incident and Import Indicators. Default is Import Indicators Only. Required if Fetch Incidents is enabled.
DomainTools Iris Investigate Search Hash	No	Required if Fetch Incidents is enabled.
Enabled on Monitoring Domains by Iris Tags	No	Determines what method to use. Options are Import Indicators Only and Create Incident and Import Indicators. Default is Import Indicators Only. Required if Fetch Incidents is enabled.
DomainTools Iris Tags	No	Contains the Iris tags to monitor. Creates incident or creates an indicator for each new domain found based on the tags. Required if Fetch Incidents is enabled.
Maximum Incidents to Fetch	No	Determines the maximum incidents to fetch. Default is 2 (one for each possible feed type: iris search hash and iris tags).
Incidents Fetch Interval	No	Determines the interval to fetch incidents (fetch results from Iris Investigate API with the given iris hash and iris tags). Required if Fetch Incidents is enabled.

5. Test connectivity with DomainTools by clicking Test and look for the Success! indicator

Configure domain enrichment

To enable DomainTools to contribute to domain verdicts in XSOAR, you need to configure the domain-type indicator to use the DomainTools Iris domain command as part of its enrichment process.

Set the DomainTools domain command as the auto-enrichment or reputation command for domain indicators:

1. Navigate to Settings > Objects Setup
2. Select the Indicators tab
3. Locate and select the Domain indicator type
4. Click Edit
5. Under the Reputation Command section, add the DomainTools domain command
6. Save your changes

After you configure this setting, every time a domain indicator is encountered, XSOAR automatically runs the DomainTools command to enrich the indicator and contribute to the overall verdict (for example, via DBotScore and Domain.Malicious context fields).

Set up the Real-time Threat Feeds integration

1. Select Settings > Integrations > Servers & Services
2. Search for FeedDomainTools to find the Real-time Threat Feeds integration
3. Select Add Instance to configure the DomainTools instance
4. Enter the configuration parameters described in the following table

For more information on these parameters, see the Real-time Threat Feeds user guide.

Parameter	Description	Required
API Username	The DomainTools API username	Yes
API Key	The DomainTools API key	Yes
Session ID	A unique identifier for the session that resumes data retrieval from the last point. On its initial use, it retrieves data from the past five days. Default is dt-cortex-feeds.	No
After	The start of the query window in seconds, relative to the current time, inclusive. Default is -3600, or one hour before the current time.	No
Top	Limits the number of results in the response payload. Especially useful for testing. Default is 5000.	No
Feed Type	Select ALL, nod, nad, noh, domainrdap, domaindiscovery, domainrisk, domainhotlist, iphotlist, or iprisk. ALL fetches all available feed types. Existing instances configured with ALL begin ingesting IP indicators after upgrading to version 1.2.0. Default is ALL.	No
Fetch indicators	Enables scheduled feed retrieval and indicator creation. Default is selected.	No
Indicator Reputation	Indicators from this integration instance are marked with this reputation.	No
Source Reliability	Reliability of the source providing the intelligence data.	Yes
Feed Fetch Interval	The feed fetching interval to use.	No
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	No
Use system proxy settings		No
Tags	Supports comma-separated values (CSV).	No
Traffic Light Protocol Color	Applied to indicators fetched from the feed.	No

Use DomainTools Iris commands

For more information about the DomainTools Iris suite, see the Iris documentation.

Command	Description
domain	Provides data enrichment for domains.
domaintools-hosting-history	Lists Internet Protocol (IP) address, name server, and registrar history.
domaintools-reverse-whois	Lists domain names that share registrant information. Enter a domain-owner attribute, such as an email address or company name, to find matching registration records.
domaintools-whois	Provides parsed information from a raw WHOIS record for searching, indexing, and cross-referencing registration records.
domaintools-whois-history	Returns up to 100 historical WHOIS records for a domain name.
domaintoolsiris-analytics	Displays DomainTools analytic data in a markdown format table.
domaintoolsiris-enrich	Returns a complete profile of the domain (second-level domain and top-level domain) using Iris Enrich. If parsing of URLs or fully qualified domain names (FQDNs) is desired, see domainExtractAndEnrich.
domaintoolsiris-investigate	Returns a complete profile of the domain (second-level domain and top-level domain) using Iris Investigate. If parsing of FQDNs is desired, see domainExtractAndInvestigate.
domaintoolsiris-pivot	Pivot on connected infrastructure (IP, email, Secure Sockets Layer (SSL)), or import domains from Iris Investigate using a search hash. Retrieves up to 5000 domains at a time. Optionally exclude results from context with include_context=false.
domaintoolsiris-threat-profile	Displays DomainTools Threat Profile data in a markdown format table.

Use the domaintools-get-indicators command

Use the domaintools-get-indicators command to retrieve feed indicators. After you successfully run the command, XSOAR adds a DBot message with the command details to the war room. All command arguments are optional:

Argument name	Description	Required
feed_type	The DomainTools integration feed type to fetch. Values are nod (default), nad, noh, domainrdap, domaindiscovery, domainrisk, domainhotlist, iphotlist, and iprisk.	No
session_id	A unique identifier for the session. On its initial use, it retrieves data from the past five days. Default is dt-cortex-feeds.	No
domain	Filter results for a top-level domain.	No
after	The start of the query window in seconds, relative to the current time, inclusive. Default is -3600, or one hour before the current time.	No
before	The end of the query window in seconds, relative to the current time, inclusive.	No
top	Limits the number of results in the response payload. Default is 50.	No
create_indicators	Creates indicators in the database when set to true. Default is false.	No

Ingest IP threat feed indicators

Use domaintools-get-indicators with feed_type="iphotlist" or feed_type="iprisk" to retrieve IP Hotlist API or IP Risk API intelligence. These feeds support analyst investigation and threat hunting by bringing IP reputation data and hosting activity into XSOAR.

Set create_indicators=true when you want the command to create DomainToolsFeed IP indicators in the database. The default, false, lets you inspect results in the war room without adding indicators. The configured integration uses scheduled feed retrieval to create indicators for its selected feed type.

IP threat feed filters

Use these optional arguments when you run domaintools-get-indicators with either IP feed unless otherwise noted:

Argument name	Description
pdns_resolutions_min	Minimum number of domains seen on the IP in the last 24 hours.
bad_pdns_resolutions_min	Minimum number of confirmed bad domains seen on the IP in the last 24 hours.
total_domains_max	Excludes IPs that host more than the specified total number of domains.
third_party_threats_min	Minimum number of domains with confirmed threats on third-party feeds.
all_threats_combined_percent_min	Minimum percentage of confirmed or predicted malicious domains, from 0 to 100.
combined_phishing_percent_min	Minimum combined phishing threat percentage, from 0 to 100.
combined_malware_percent_min	Minimum combined malware threat percentage, from 0 to 100.
combined_spam_percent_min	Minimum combined spam threat percentage, from 0 to 100.
asn	Autonomous system number to match. Use digits only.
organization	Exact organization name to match.
country_code	Two-letter country code to match the IP geolocation.
percent_phishing_min	Minimum confirmed phishing percentage, from 0 to 100.
percent_malware_min	Minimum confirmed malware percentage, from 0 to 100.
percent_spam_min	Minimum confirmed spam percentage, from 0 to 100.
all_threats_percent_min	For IP Risk only, minimum percentage for all threat classifications combined, from 0 to 100.

IP threat feed examples

Retrieve up to 10 IP Hotlist indicators:

!domaintools-get-indicators feed_type="iphotlist" session_id="dt-iphotlist-cortex" top="10"

Retrieve up to 10 IP Risk indicators in the United States with at least 50% confirmed malware:

!domaintools-get-indicators feed_type="iprisk" country_code="US" percent_malware_min="50" top="10"

IP indicator fields

Scheduled feed retrieval, or a manual command run with create_indicators=true, creates DomainToolsFeed IP indicators with DomainTools reputation data, a DBotScore, and IP-specific fields. The command has no context output. A successful run adds a DBot message that summarizes the command details to the war room.

Field name	Description
DomainToolsFeed IP All Threats Combined Count	Number of confirmed or predicted malicious domains hosted on the IP.
DomainToolsFeed IP ASN	The IP’s ASN (autonomous system number, routing provider).
DomainToolsFeed IP All Threats Combined Percent	Percentage of total domains on the IP that are confirmed or predicted malicious.
DomainToolsFeed IP All Threats Percent	Percentage of total domains on the IP including all threat types.
DomainToolsFeed IP Bad PDNS Resolutions	Number of confirmed bad domains seen on the IP in the last 24 hours.
DomainToolsFeed IP City	City derived from geolocation data for the IP address.
DomainToolsFeed IP Combined Malware Percent	Percentage of total domains on the IP that are confirmed or predicted as malware.
DomainToolsFeed IP Combined Phishing Percent	Percentage of total domains on the IP that are confirmed or predicted as phishing.
DomainToolsFeed IP Combined Spam Percent	Percentage of total domains on the IP that are confirmed or predicted as spam.
DomainToolsFeed IP Compromised Malware	Number of compromised malware domains hosted on the IP.
DomainToolsFeed IP Compromised Phishing	Number of compromised phishing domains hosted on the IP.
DomainToolsFeed IP Compromised Spam	Number of compromised spam domains hosted on the IP.
DomainToolsFeed IP Country	Country derived from geolocation data for the IP address.
DomainToolsFeed IP Feed Timestamp	ISO 8601 UTC timestamp when the IP risk assessment was last updated.
DomainToolsFeed IP Latitude	Geographic latitude coordinate of the IP address.
DomainToolsFeed IP Longitude	Geographic longitude coordinate of the IP address.
DomainToolsFeed IP Malicious Malware	Number of confirmed malware domains on third-party intel feeds hosted on the IP.
DomainToolsFeed IP Malicious Phishing	Number of confirmed phishing domains on third-party intel feeds hosted on the IP.
DomainToolsFeed IP Malicious Spam	Number of confirmed spam domains on third-party intel feeds hosted on the IP.
DomainToolsFeed IP Organization	Organization associated with the IP address range based on geolocation data.
DomainToolsFeed IP PDNS Resolutions	Number of domains seen on the IP in the last 24 hours.
DomainToolsFeed IP Percent Malware	Percentage of total domains on the IP that are confirmed malware.
DomainToolsFeed IP Percent Phishing	Percentage of total domains on the IP that are confirmed phishing.
DomainToolsFeed IP Percent Spam	Percentage of total domains on the IP that are confirmed spam.
DomainToolsFeed IP Predicted Malware	Number of domains (with no confirmed threat) predicted as malware hosted on the IP.
DomainToolsFeed IP Predicted Phishing	Number of domains (with no confirmed threat) predicted as phishing hosted on the IP.
DomainToolsFeed IP Predicted Spam	Number of domains (with no confirmed threat) predicted as spam hosted on the IP.
DomainToolsFeed IP Third Party Threats	Number of domains on the IP confirmed with any threat on a third-party intel feed.
DomainToolsFeed IP Total Domains	Total number of domains seen on the IP in the last 7 days.
DomainToolsFeed IP Zerolist Domains	Number of zero-listed domains seen on the IP (e.g., from CDNs or shared infrastructure).
DomainToolsFeed IP Zerolist IP	Indicates whether the IP is zero-listed (e.g., a CDN or other shared infrastructure).

Use DomainTools Iris automations

Automation	Description
AddDomainRiskScoreToContext	Sets average risk score to context for pivot result.
AssociateIndicatorsToIncident	Associates indicators to an incident.
CheckLastEnrichment	Checks if DomainTools data needs enrichment.
CheckPivotableDomains	Checks for guided pivots for a given domain.
CheckTags	Checks DomainTools domain tags and if a tag is found, marks incident as high severity.
DomainExtractAndEnrich	Resolves a URL or fully qualified domain name (FQDN) and looks up a complete profile of the domain on the DomainTools Iris Enrich API.
DomainExtractAndInvestigate	Resolves a URL or fully qualified domain name (FQDN) and looks up a complete profile of the domain on the DomainTools Iris Investigate API.
SetIndicatorTableData	Sets data for a domain in the indicator table.

Use DomainTools Iris playbooks

Get started with custom playbooks

In addition to the automation available within Palo Alto XSOAR, you can download automation scripts from the DomainTools Palo Alto XSOAR repository in GitHub.

Customize error handling

XSOAR playbooks halt on errors by default. Some DomainTools playbooks may generate errors, such as when they receive unregistered domains, that you want to skip.

You can modify a playbook’s error handling via its On Error tab in Task Details in several ways:

• Specify a permitted number of retries and the time between retries
• Set the task to continue through an error
• Set the task to take an error path

For more information about customized error handling, see this YouTube video from Palo Alto.

Check prerequisites

Before you upload these custom playbooks, review the Prerequisites section for each. It identifies any additional configurations and dependencies associated with these playbooks.

Playbook: DomainTools Auto Pivots

View on GitHub

This playbook fetches the Iris Investigate profile of a domain and uses DomainTools Guided Pivot values to identify related infrastructure.

Playbook: DomainTools Check Domain Risk Score By Iris Tags

View on GitHub

This playbook periodically checks domains for risk based on Iris Investigate tags. You can define a list of tags to monitor, and the playbook adds new high-risk domains as indicators on associated incidents.

Playbook: DomainTools Check New Domains by Iris Hash

View on GitHub

This playbook monitors new domains that match predefined infrastructure criteria, such as registrar, DNS, or SSL certificate data. It uses Iris Investigate data to identify newly registered domains.

Playbook: DomainTools Domain Auto Enrichment

View on GitHub

This playbook can reduce duplicate enrichment and store selected results in the XSOAR indicator table:

• Checks if enrichment data is recent; if so, skips redundant enrichment of the domain
• Performs domain enrichment
• Stores key enrichment intelligence in Palo Alto XSOAR indicator table

Prerequisites

Automation scripts: The playbook uses the following automation scripts to deliver these functionalities. Both of these are available for download in the scripts folder of the same repository:

• DomainToolsCheckLastEnrichment
• DomainToolsSetIndicatorTable

Custom indicator fields: The playbook uses the following custom fields in the indicator table to store DomainTools intelligence in Palo Alto XSOAR. Create these fields before you execute the playbook:

1. Select Settings > Advanced > Fields
2. Select Indicator from the dropdown list
3. Add new fields per the following table:

Field name	Field type	Mandatory
additionalWhoisEmails	Short text	No
domainAge	Short text	No
emailDomains	Short text	No
ipAddresses	Short text	No
mailServers	Short text	No
nameServers	Short text	No
soaEmail	Short text	No
spfRecord	Short text	No
sslCertificate	Short text	No

4. The same fields appear in an indicator table after you create them successfully

Playbook: DomainTools Iris Tags

View on GitHub

The DomainTools_Iris_Tags playbook checks domains against a list of Iris tags and can raise an incident’s severity when a tag matches. It:

• Lets you configure a list of Iris tags to monitor in Palo Alto XSOAR
• Automates checking for any indicators that match one of the tags
• Escalates the incident severity to ‘High’

Prerequisites

Create tags in DomainTools Iris: To use this feature, create tags in DomainTools Iris. After you tag a domain in Iris, the tags become available in Palo Alto XSOAR. For more information, see “Tagging domains” in the Iris Investigate user guide.

Automation scripts: The playbook uses the DomainToolsCheckTags script, which is available for download in the scripts folder of the same repository.

Custom tag list: Palo Alto XSOAR users can store the list of tags inside Palo Alto XSOAR by following these steps:

1. Select Settings > Advanced > Lists > New List
2. Set values:
   • Name: tags
   • Data: Your comma-delimited list of tags

Usage examples

Enrich a domain

Enriches domain-related data from the Iris dataset, including domain risk scores, WHOIS, IP, active DNS, website, and SSL data. Enables rapid enrichment of proxy and DNS logs, enhancing the ability to detect and respond to threats in real-time. You can identify malicious domains and assess their risk levels efficiently.

Query DomainTools for DNS intelligence for a specific indicator:

!domain domain="example.com"

Retrieve DomainTools analytics

Actionable analytics from Iris

!domaintoolsiris-analytics domain="example.com"

Risk scores, threat profiles, and evidence

!domaintoolsiris-threat-profile domain=example.com

Discover connected infrastructure

Pivot on any of the following DomainTools attributes to discover potentially malicious infrastructure associated with the DNS artifact:

• IP
• Email
• Mailserver_Host
• Nameserver_Host
• Nameserver_IP
• SSL Hash

For example, a pivot on the hosting IP address:

!domaintoolsiris-pivot ip="199.79.62.18"

Retrieve latest results for Newly Observed Domains (NOD) Threat Feed

!domaintools-get-indicators session_id=mysession feed_type=nod