Skip to content
DomainTools Technical Documentation

DomainTools App for Splunk Enterprise, Cloud, and Enterprise Security

Overview

Section titled “Overview”

The DomainTools App for Splunk brings DomainTools Iris, Farsight DNSDB, and domain history data into Splunk. Use it to enrich, investigate, and monitor domains observed in your environment.

For help with the Splunk app and features, visit Splunk technical documentation. The DomainTools App for Splunk is on Splunkbase at https://splunkbase.splunk.com/app/5226. Note the separate DomainTools App for Splunk SOAR.

Key features

Section titled “Key features”
  • Real-time threat intelligence enrichment - Automatically enrich domain observations with DomainTools threat data
  • Iris Enrich, Investigate, and Detect integration - Access the full Iris platform capabilities within Splunk
  • Farsight DNSDB passive DNS lookups - Query historical DNS data for investigation
  • Automated alerting and monitoring - Create notable events and alerts based on risk thresholds
  • Custom dashboards and visualizations - Pre-built dashboards for threat intelligence and domain monitoring
  • Threat Feeds - Query or import real-time domain and IP feeds, including IP Hotlist, IP Risk, NOD, NAD, NOH, and Domain Discovery

Prerequisites overview

Section titled “Prerequisites overview”

Before installing the DomainTools App, ensure you have:

  • Splunk Enterprise Security (ES) or Splunk (non-ES)
  • DomainTools API key with access to the APIs and feeds you plan to use — see Authentication for credential setup
  • Firewall access - Splunk must be able to reach api.domaintools.com
  • Splunk credentials - Administrator access to install and configure the app
  • Prior versions uninstalled - Remove any 3.x or 4.x versions before installing

For detailed prerequisites, see the Installation Guide.

Quick start

Section titled “Quick start”
  1. Install the app - Follow the installation guide for your Splunk deployment type (Cloud, on-premise, or distributed)
  2. Configure base settings - Set up your base search, saved searches, and enrichment settings
  3. Explore the Iris Enrich dashboards - View threat intelligence and monitor suspicious domains

Documentation

Section titled “Documentation”

Getting started

Section titled “Getting started”
  • Installation Guide - Install the app on Splunk Cloud, Enterprise, or distributed environments
  • DT Settings - Configure base search, saved searches, and enrichment

Using the app

Section titled “Using the app”
  • Iris Enrich - View the latest enrichment data on the Threat Intelligence and Domain Monitoring dashboards, and manage monitored domains and tags
  • Iris Investigate - Pull a domain’s current Iris Investigate profile, run guided pivots, and import domains from an Iris search hash
  • Farsight DNSDB - Investigate current and historical domain infrastructure with Passive DNS using DNSDB Standard and Flexible search
  • Iris Detect - Triage new and changed domains matching your Iris Detect monitored terms, and sync the Iris Detect Watch List with your Splunk Monitoring List
  • Enrichment Explorer - Search and filter DomainTools intelligence from the app cache for domains observed in your network
  • WHOIS History - Retrieve historical WHOIS records for a domain and display the results in a table
  • Domain RDAP - Look up Parsed Domain RDAP API results for a domain and display them in a table
  • Search - Run DomainTools custom search commands and query threat feed indexes from the standard Splunk search interface

Release notes

Section titled “Release notes”

Version 5.8

Section titled “Version 5.8”

DomainTools App for Splunk 5.8 adds IP Hotlist and IP Risk searches and expands the parameters available to the existing threat feed commands.

New in version 5.8:

Updated in version 5.8:

  • Threat feed command parameters - Existing feed commands support time-window, session, and result-limit parameters consistent with the Threat Feeds API.

Fixed in version 5.8:

  • Added validation for incompatible IP feed session parameters.
  • Fixed overlapping text on the Iris Investigate Domain Profile page.
  • Improved compatibility with Splunk AppInspect validation.

Version 5.7

Section titled “Version 5.7”

DomainTools App for Splunk 5.7 adds the irisql option to dtirisinvestigate.

New in version 5.7:

  • IrisQL query support - Query Iris Investigate with IrisQL directly from Splunk Search Processing Language (SPL).

Version 5.6

Section titled “Version 5.6”

DomainTools App for Splunk 5.6 is a minor release focused on quality-of-life enhancements.

Updated in version 5.6:

  • Updated Python Wrapper for feed streaming

Fixed in version 5.6:

  • Fixed Splunk Cloud Platform compatibility issue

Version 5.5

Section titled “Version 5.5”

DomainTools App for Splunk 5.5 includes new threat feed support and bug fixes.

New in version 5.5:

Fixed in version 5.5:

  • Fixed Iris Detect domains showing inconsistent results with escalated domains

Version 5.4.1

Section titled “Version 5.4.1”

Updated in version 5.4.1:

  • The tldextract library includes private domains as TLDs
  • Support for socks5/socks5h proxies with support for remote DNS resolution
  • Recent Events table is now its own dashboard
  • Turn off logging on domainextract by default

Version 5.4

Section titled “Version 5.4”

New in version 5.4:

Updated in version 5.4:

  • 206 response handling: Instead of timing out on large data sets, the Splunk app now returns the entire data set using multiple API calls. Consult the Feeds documentation for information about 206 responses.
  • Python updated to 3.9 for Splunk SDK

Fixed in version 5.4:

  • Setup logger (splunk.setupSplunkLogger) only runs when enabled

Prior version 5.x release notes

Support

Section titled “Support”

For help with the DomainTools App for Splunk: