Connect DomainTools Threat Feeds to Microsoft Sentinel

DomainTools CCF adds the DomainTools Threat Intelligence Domain Feed data connector to Microsoft Sentinel. Use it to ingest DomainTools Threat Feeds for investigation, hunting, dashboards, and analytics. The connector is separate from the DomainTools Logic App integrations used for on-demand enrichment and Farsight DNSDB lookups.

Included connector content

The connector writes records from four DomainTools Threat Feeds to the DomainToolsThreatIntelDomains_CL table.

Threat Feed	domaintype value
Newly Observed Domains (NOD)	nod
Newly Active Domains (NAD)	nad
Newly Observed Hostnames (NOH)	noh
Domain Discovery	domaindiscovery

The DomainTools CCF solution also includes:

• Parser function: DomainToolsThreatIntelDomains
• Workbook: DomainTools Threat Intelligence Dashboard
• Analytics rules: Four templates, one for each feed

Prerequisites

Before you connect the feeds, verify that you have:

• Microsoft Sentinel workspace access
• Azure permission to install Content hub solutions and configure data connectors in the workspace
• DomainTools subscription for the Threat Feeds you intend to ingest
• DomainTools API key

The connector requests one DomainTools API key. It doesn’t request an API username.

Install DomainTools CCF

View the DomainTools Threat Intelligence listing in Microsoft Marketplace before you install the solution.

1. Open your Microsoft Sentinel workspace.

2. Select Content hub.

3. Search for DomainTools CCF.

4. Select the solution, and then install it.

The installed solution adds the data connector, parser, workbook, and analytics rule templates to your workspace.

Connect the data connector

1. In Microsoft Sentinel, select Data connectors.

2. Select DomainTools Threat Intelligence Domain Feed.

3. Open the connector page.

4. Enter your DomainTools API key.

5. Select Connect.

Verify ingestion

After records arrive, run this Kusto Query Language (KQL) query in Microsoft Sentinel Logs:

DomainToolsThreatIntelDomains_CL
| sort by TimeGenerated desc
| take 20

A successful query returns recent records with the TimeGenerated, timestamp, domain, and domaintype columns. If the query returns no rows, verify the connector status and your feed entitlements before contacting support.

Query data with the parser

Use the included parser function when building hunts, workbooks, or analytics:

DomainToolsThreatIntelDomains
| take 20

To review ingestion by feed, summarize the parser output by domaintype:

DomainToolsThreatIntelDomains
| summarize Records = count() by domaintype
| sort by Records desc

Data fields

The connector publishes these fields:

Field	Description
TimeGenerated	Timestamp used by Microsoft Sentinel for the record
timestamp	Timestamp supplied with the Threat Feed record
domain	Domain or hostname supplied by the feed
domaintype	Feed identifier shown in the preceding mapping

Use the workbook and analytics rule templates

Open Workbooks and select DomainTools Threat Intelligence Dashboard to review the ingested data.

Each of the four included analytics rule templates evaluates records hourly, uses medium severity, and creates incidents when matching records exist. Review each template’s query, schedule, severity, incident settings, and enabled state before relying on it. Tune the templates for your environment, particularly for the higher-volume Newly Observed Hostnames feed.

Get support

Contact enterprisesupport@domaintools.com for help with DomainTools credentials, feed entitlements, or connector behavior.

Related resources

• Use the Threat Feeds overview to compare feed coverage and intended uses.
• Review Threat Feed use cases for hunting, detection, enrichment, and monitoring workflows.
• Choose another Microsoft Sentinel integration for on-demand enrichment or Farsight DNSDB lookups.