Skip to content
DomainTools Technical Documentation

DomainTools integrations for Microsoft Sentinel

DomainTools provides a Threat Feeds data connector and three Logic App integrations for Microsoft Sentinel. Use the connector for continuous feed ingestion, or use the Logic Apps for on-demand incident enrichment and Farsight DNSDB lookups.

Choose an integration

Section titled “Choose an integration”
IntegrationUse it to
Threat Feeds connectorIngest Newly Observed Domains, Newly Active Domains, Newly Observed Hostnames, and Domain Discovery records into Microsoft Sentinel
Iris InvestigateInvestigate domains and related infrastructure from Sentinel incidents
Iris EnrichEnrich domains with risk and infrastructure context
Farsight DNSDBQuery historical passive DNS data from Sentinel

Threat Feeds connector

Section titled “Threat Feeds connector”

The DomainTools Threat Intelligence Domain Feed connector is part of the DomainTools CCF solution in Microsoft Sentinel Content hub. It writes feed records to DomainToolsThreatIntelDomains_CL and includes a parser, workbook, and analytics rule templates.

Connect DomainTools Threat Feeds to Microsoft Sentinel to install the solution, configure your API key, and verify ingestion.

Logic App integrations

Section titled “Logic App integrations”

The Iris Investigate, Iris Enrich, and Farsight DNSDB integrations use Azure Logic Apps and reference playbooks. They have different subscriptions, credentials, Azure permissions, and setup steps than the Threat Feeds connector.

Choose the guide for the DomainTools product you want to use:

Get help

Section titled “Get help”
Section titled “Related resources”