Splunk Enterprise app advanced configuration

Advanced configuration covers the setup steps that live outside the DT Settings pages: creating the Splunk indexes the app writes to, enabling threat feeds, wiring feeds into Splunk Enterprise Security (ES), and using the Parsed Domain RDAP API.

Create the required indexes

The DomainTools App stores its current-state data (enrichment cache, monitoring list, allowlist) in KV store collections that the app creates automatically. Its optional features instead write to Splunk event indexes, which the app does not create — you must create each one before enabling the feature that writes to it, or Splunk silently drops the events.

Create only the indexes for the features you plan to use:

Index	Needed for	Written by
dt_feed_domain_discovery	Domain Discovery feed	DomainTools - Feed - Domain Discovery
dt_feed_domain_hotlist	Domain Hotlist feed	DomainTools - Feed - Domain Hotlist
dt_feed_domainrisk	Domain Risk feed	DomainTools - Feed - Domain Risk
dt_feed_nad	Newly Active Domains feed	DomainTools - Feed - NAD
dt_feed_nod	Newly Observed Domains feed	DomainTools - Feed - NOD
dt_feed_noh	Newly Observed Hostnames feed	DomainTools - Feed - NOH
dt_feed_rdap	Parsed Domain RDAP feed	DomainTools - Feed - RDAP
dt_alerts	Alerting without Enterprise Security	The four alert - Rule saved searches
dt_enrich_history	Enrichment history, and the Risk Score Increase alert	DomainTools - Iris Enrich History

Use the exact index names in the preceding table — the saved searches write to these fixed names, so a mismatched index receives no data. For how to create an index, see how to create event indexes in the Splunk documentation. In a distributed deployment, create the indexes on your indexers or indexer cluster peers.

Notable event field labels (ES)

The alert rule saved searches (DomainTools - DomainTools Domain Monitoring - Rule, ... Young Domains - Rule, ... Iris Detect - Rule) emit these fields to the dt_alerts logevent, with the labels shown. Configure the matching field labels during initial setup in your Enterprise Security module so notable events display them:

• domain: Domain
• dt_age: DomainAge
• dt_is_active: DomainStatus
• en_threat_profile_type: ThreatProfileType
• dt_num_of_times_enriched: EnrichmentCount
• dt_looyn_date: LastSeen
• en_risk_score: RiskScore
• log_source: LogSource
• url: URL

dt_age, dt_is_active, and dt_looyn_date are computed inside the rule searches (dt_looyn_date is dt_looyn_timestamp formatted as %Y-%m-%d), so they exist only on the alert output, not in the enrichment KV store. Once configured, notable events display these fields automatically. There’s no programmatic way to provision the labels during app deployment. For detailed steps, see how to add a field to notable event details.

Configure threat feeds (Splunk ES)

Add a DomainTools threat feed as a threat intelligence source in Splunk Enterprise Security.

1. Navigate to threat intelligence management

In Splunk ES, go to Configure → Threat Intelligence Management from the top menu bar.

2. Create a new threat source

On the Threat Intelligence Sources page, select New, then Line Oriented.

3. Configure general settings

Fill out the fields with your feed’s details:

• Name: A unique name for the feed. This becomes the value of the threat_key field, which you search on. Example: nod_domains_feed
• Description: A clear description of the feed’s purpose. Example: Newly Observed Domains from DomainTools API.
• Type: domain (the indicator type this feed provides).
• URL: The full URL of the feed API endpoint. Example: https://api.domaintools.com/v1/feed/nod/?api_key=YOUR_API_KEY&api_username=YOUR_API_USERNAME&after=-60
• Weight: A number used to calculate risk scores for assets that match this intelligence. Example: 60
• Interval: How often Splunk fetches the feed, in seconds. Example: 60
• Max Age (optional): How long to retain indicators. Use s, m, h, or d for time units. Example: -30d
• Max Size (optional): Maximum download size in bytes. Example: 104857600 (100 MB)

4. Configure parsing settings

These settings tell Splunk how to extract the domain and timestamp from each line of the feed:

• File Parser: auto
• Delimiting regular expression: Leave empty — each line is a self-contained event (a single JSON object).
• Extracting regular expression: {"timestamp":"([^"]+)","domain":"([^"]+)"}
• Ignoring regular expression: Leave empty.
• Fields: Maps the captured groups to Splunk fields. Example: timestamp:$1, domain:$2
• Skip header lines: 0 (NOD has no header).

5. Save and enable

Select Save, then find your feed in the list and confirm it’s Enabled. Splunk begins downloading and processing the feed on the schedule you set.

Query an ES threat source

A feed added through ES Threat Intelligence Management lands in the ES ip_intel KV store collection, keyed by the threat_key (the feed Name from step 3) — NOT in a dt_feed_* index. This is a different mechanism from the DomainTools app’s own feed saved searches. Query it with inputlookup:

| inputlookup ip_intel | head 10

The fields are typically domain (the indicator), time (a Unix epoch timestamp), and threat_key (the feed name). Filter on threat_key:

| inputlookup ip_intel
| search threat_key="nod_domains_feed"
| sort - time
| head 100
| eval _time=time
| table _time, domain, threat_key

Enable threat feeds

Enabling a DomainTools threat feed takes two steps: create the Splunk index the feed writes to, then enable the matching feed saved search.

1. Create the index. Each DomainTools - Feed - * saved search runs | collect index=… against a fixed index name. Create the matching dt_feed_* index first, as described in Create the required indexes — if it doesn’t exist, Splunk’s collect command silently drops the events.
2. Enable the feed saved search. In DT Settings → Configure Saved Searches, enable the matching DomainTools - Feed - * report. It ships disabled with a */5 * * * * schedule already defined. Once enabled, it pulls feed results and writes them into the index you created.

To query feed results once enabled, see Threat feeds. For complete feed details, see the Real-time Threat Feeds documentation.

Enable the Parsed Domain RDAP API

The Parsed Domain RDAP API is a lookup service, separate from the Parsed Domain RDAP Feed enabled under Enable threat feeds.

Return Parsed Domain RDAP API results with the dtparseddomainrdap search command, which supports only the domain parameter. See Custom search commands for the command, and Domain RDAP for the results page.

Related resources

• DT Settings — enable saved searches, alerting, and enrichment settings
• Search — query the threat feed indexes you create here
• Configuration tables and troubleshooting — configuration files and KV store reference