Splunk Enterprise app DT Settings

DT Settings is where you configure the DomainTools App: API credentials, the log source the app monitors, saved searches, alerting, enrichment and caching, and diagnostics. Each section below maps to a page in the DT Settings menu. For threat feeds and the Parsed Domain RDAP API, see Advanced configuration.

API Keys

The API Keys page (DT Settings > API Keys) manages your DomainTools API key and validates connectivity with DomainTools, and optionally Farsight.

Review API credentials for information on obtaining your credentials.

Enter your API credentials

• DomainTools API Credentials (Required)
  • Enter your DomainTools API Username and DomainTools API Key.
• Farsight API Credentials (Optional)
  • Enter your Farsight API Key, only required when using Farsight DNSDB.

When you save new credentials, the app prompts you with Would you like to enable the default set of Saved Searches? Select Enable to turn them on.

Configure proxy and SSL

Use the Proxy and SSL groups on this page to route API calls through a proxy or present a custom certificate:

• Select Enable Proxy to reveal the Proxy Server and Proxy Port fields.
  • If the proxy requires authentication, select Enable Proxy Authentication to input the username and password.
• Select Enable Custom SSL Certificate to set the Custom SSL Certificate Path.

These fields in domaintools.conf back the UI controls and manage the proxy and SSL connection to the DomainTools API:

Field	Description
proxy_enabled	Use a proxy when connecting to the DomainTools API. To enable, set to 1. Corresponds to the Enable Proxy UI field.
proxy_server	The proxy server address to use. Corresponds to Proxy Server.
proxy_port	The proxy server port to use. Corresponds to Proxy Port.
proxy_authentication	Authenticate to the proxy server. To enable, set to 1. Corresponds to the Enable Proxy Authentication UI field, which reveals the Proxy Username and Proxy Password fields.
ssl_enabled	Use SSL when connecting to the DomainTools API. To enable, set to 1.
custom_certificate_enabled	Use a custom SSL certificate for the SSL connection. To enable, set to 1. Corresponds to the Enable Custom SSL Certificate UI field.
custom_certificate_path	The path to the custom SSL certificate. Corresponds to Custom SSL Certificate Path.

Test the connection

Verify your credentials:

1. Select Test Connection/View Account Information to verify provisioning.
2. Select Update to save.

Test results appear below the buttons. The first table lists every DomainTools API your key can reach, with a row per API and columns for API Product Expires, Absolute Limit, Maximum Requests/Min, Maximum Requests/Month, Requests Today, Requests this Month, and Info. If you entered a Farsight API key, a second table shows the Farsight DNSDB row with its Queries Left and Time until Quota Reset.

The app requires these APIs for base capability:

• iris-enrich
• iris-investigate
• iris-detect-monitors — read-only access to the monitored Iris Detect terms within Splunk.
• iris-detect-new-domains — read-only access to new domains matching monitored terms.
• iris-detect-watched-domains — read-only access to the domains marked as watched in Iris Detect, and updates to that list. You can optionally synchronize those domains with the Splunk Monitoring List.

These APIs are optional:

• iris-detect-manage-watchlist-domains — add domains to the Iris Detect Watchlist to track infrastructure changes over time.
• iris-detect-escalate-domains — add domains to the blocklist and submit them to Google Safe Browsing.
• newly-active-domains-feed-(api) — the Newly Active Domains (NAD) threat feed.
• newly-observed-domains-feed-(api) — the Newly Observed Domains (NOD) threat feed.

Iris Detect works without the optional permissions, but you receive an error if you try to watch, block, escalate, or ignore a domain in the Iris Detect Results panel. The threat-feed APIs appear only when your key is provisioned for them.

API Usage

The API Usage page is an operational dashboard for DomainTools enrichment activities and API usage, so you can track activity against your provisioned limits. The app determines your provisioned APIs and monthly limits with the dtaccountinfo command, and reads DNSDB rate limits with dtdnsdblimit.

The page is organized into three sections.

Overall Enrichment

Summarizes how many domains the app has enriched:

• Total Enrichments — the total number of enrichments performed.
• Bulk Enrichment — enrichments performed through the app’s scheduled bulk enrichment.
• Domains Profiled — the number of ad hoc lookups performed.

Usage against limits

Tracks consumption per API against your provisioned limits. The Time Range selector sets the reporting window for this section, with two options: 1 Day and 1 Month (the default). Each API shows as a gauge:

• Iris Enrich Usage, Iris Investigate Usage, and Iris Detect Usage — usage against each API’s monthly limit, drawn from dtaccountinfo.
• DNSDB API Usage — remaining DNSDB queries, drawn from dtdnsdblimit. Accounts with an unlimited plan show UNLIMITED.

Enrichment Activity

Charts enrichment volume over time as chosen in the Time Range selector above:

• Hourly Enrichment Count — bulk enrichment volume per hour.
• Hourly Adhoc Lookups Count — ad hoc lookup volume per hour.

Configure Log Source

The base search is a Splunk Search Processing Language (SPL) query that defines which log sources the app monitors. It outputs the fields the app uses to populate dashboards and enrich events. SPL is Splunk’s query language for searching and analyzing data; for its full syntax, see the Splunk Search Reference.

The app includes a pre-configured, performance-optimized base query that works well where data sources follow the Common Information Model (CIM) — Splunk’s standard for normalizing data from different sources into a consistent format.

To configure the base search:

1. Visit DT Settings → Configure Log Source.
2. Enter your query in the Base Search field and configure the required fields: url, src, dest, log_source, domain, and _time.
3. Select Test Base Search (up to 10 most recent entries) to preview what the base search returns before you save.
4. Select Save.

Use the pre-configured base search

First, identify relevant CIM-compliant data sources for ingestion. For example, you might use data sources already configured to capture web proxy events. If your data sources aren’t CIM-compliant, use custom SPL instead (see below).

1. Visit the DT Settings → Configure Log Source page.
2. Confirm the details of the pre-configured Splunk search query.
3. If needed, customize the pre-configured base search so the required fields are available.
4. Select Save.
5. Select the timeframe for the base search.

The app natively supports logs with multivalue URLs in a single event entry, commonly seen in Proofpoint logs. If you previously used mvexpand url to work around this, you can remove that command — the app reports the URLs more accurately as a single event.

A regex-based dtdomainextract2 macro is available for high-throughput environments. It can speed up URL-to-domain conversion with a slight trade-off in accuracy: some wildcard and exception top-level domains (TLDs) like *.np or \!city.kawasaki.jp can be misidentified as a domain. mvexpand url is still needed with dtdomainextract2 in environments processing multivalue URLs. The updated base search looks like this:

tstats summariesonly=true count FROM datamodel=Web BY Web.url Web.src Web.dest source _time | rename Web.url AS url | rename Web.src AS src | rename Web.dest AS dest | rename source AS log_source | mvexpand url | `dtdomainextract2` | eval domain=lower(domain) | fields url src dest log_source domain _time

Base search requirements and recommendations:

• You need domain and _time as output fields to operate the app.
• Add the optional fields src, dest, and log_source for more context on events. The app won’t error if these are missing.

Performance considerations:

• Turn on acceleration for the Web data model. Acceleration pre-computes search results to speed up queries.
• If acceleration isn’t on but you mapped data to the CIM, you can set summariesonly=false in the base search. This may reduce performance.
• If you already extract domains in the CIM, remove dtdomainextract from the base search to improve performance.

Configure a custom SPL base search

Configure a custom SPL base search if your data isn’t yet CIM-compliant, or if you ingest data from several different sources.

First, identify relevant data sources for ingestion. They may contain URLs or hostnames in addition to domain names. The app doesn’t support IP addresses for processing — the DomainTools solution provides data on domain names, not IPs, subdomains, or full URLs. IPs sent to the Iris APIs won’t return useful data and consume rate-limited resources. The default base search converts URLs to apex domains for enrichment.

To configure custom SPL:

1. Craft an SPL query that efficiently finds events from your data sources. You don’t need to write regular expressions to extract domains or de-duplicate logs — the DomainTools queue builder handles that. Use tstats for optimization, as the pre-configured base search does.
2. Add the query as the base search on the DT Settings → Configure Log Source page.
3. Add the query in the Base Search input field and select Save.

Your custom SPL must meet these criteria:

• If it doesn’t begin with tstats, add search so it merges correctly into the DomainTools scheduled searches.
• Don’t start with a pipe (|) character.
• Ensure the result contains a field named domain, or use rename.
• The search must efficiently return the last 10 minutes of events — ideally in a few seconds, and no longer than two or three minutes.

Example:

search index=mycustomindex | rename url AS domain

If you don’t use the default tstats base search, there’s a known issue in clustered search head environments for Splunk 7.x and 8.x. See the troubleshooting section and the Splunk 8.1.0 known issues.

Trade-offs: pre-configured vs custom SPL

Pre-configured base search:

• Pros: No post-install customization beyond the API key; finds domains in every CIM-compliant Web data model source; fast for most environments.
• Cons: Requires CIM-compliant sources using the Web data model with hostnames in Web.url; the Threat Hunting Dashboard is empty if the base search can’t find domains; you must turn on Web data model acceleration.

Custom SPL base search:

• Pros: Doesn’t require CIM compliance; you can optimize it to your environment and data sources.
• Cons: May cause performance problems if not manually optimized; may require tuning after installation, making it unsuitable for rigorous change management cycles; must return the hostname or domain in a field named domain.

Manage Allowlist

Add trusted domains to the allowlist to reduce noise and false positives when you alert on domain monitoring. Visit DT Settings → Manage Allowlist, choose an Allowlist Behavior, then use Add To Allowlist or Remove From Allowlist to manage domains:

Allowlist behavior:

• Exclude from alerts and dashboards (default): Domains in the allowlist aren’t counted toward dashboard visuals or alerts.
• Exclude from alerts (ES only): Domains aren’t alerted on but still appear in dashboard visuals.
• Excludes from dashboards: Domains don’t appear in dashboard visuals but still appear in alerts.
• Exclude from all enrichment: Fully ignores the domain in all enrichment, alerts, and visuals.
• Do nothing (overrides alert settings, if configured): The allowlist is informational only. Domains remain enriched, alerted on, and shown in dashboard visuals. This is helpful for temporary use when debugging.

Added domains appear in the allowlist with Domain Name, Last Updated Date Time, Last Updated By, Added Date Time, Added By, and Action.

Configure Saved Searches

Saved searches automate operational tasks within Splunk. Manage them in DT Settings → Configure Saved Searches.

After you enter your API key and select Test Connection, if the Queue Builder for Iris Enrich KV Store saved search is off, the app prompts you to enable the default set. Enabling turns on the minimum required saved searches for core app functionality. To turn on Iris Investigate, Iris Detect, or alerting in Splunk Enterprise Security, enable the corresponding saved searches in the table below. To enable a saved search, select Edit, then Edit Schedule.

Every saved search ships disabled with its schedule already defined, so enabling one is a matter of turning it on — you don’t need to set a cron schedule yourself. One or more required saved searches being turned off is a common cause of incomplete app functionality. To check their status, open DT Settings → Configure Saved Searches and compare the scheduled times against the table below to confirm the required core saved searches are enabled.

Name	Type	Description	Required	App functions
DomainTools - DNSDB Cache Cleanup	Reports	Clears all cached responses over a day old. Default cron_schedule = 0 0 * * *.	Required for DNSDB	Farsight DNSDB
DomainTools - Expire Old Iris Detect Data	Reports	Removes domains imported more than 14 days ago. Default cron_schedule = 0 0 * * *.	Required for Iris Detect	Iris Detect
DomainTools - Expire Old Iris Enrich Data	Reports	Removes Iris Enrich enrichment data from dt_iris_enrich_data based on the configured cache retention. Default cron_schedule = 0 0 * * *.	Required for Iris enrichment	Core App
DomainTools - Expire Old Pivot Data	Reports	Removes Iris Investigate pivot results older than 24 hours. Default cron_schedule = 0 0 * * *.	Required for the pivot feature in the Domain Profile dashboard	Core App
DomainTools - Expire Old Queue Data	Reports	Removes Iris Enrich domains from dt_iris_enrich_queue that are over a day old. Default cron_schedule = 0 0 * * *.	Required for Iris enrichment	Core App
DomainTools - Feed - Domain Discovery	Reports	Retrieves results from the real-time Domain Discovery feed. Default cron_schedule = */5 * * * *.	Optional: required for the Domain Discovery feed	Domain Discovery feed
DomainTools - Feed - Domain Hotlist	Reports	Retrieves results from the real-time Domain Hotlist feed of high-risk, apex-level domains observed active within 24 hours. Default cron_schedule = */5 * * * *.	Optional: required for the Domain Hotlist feed	Domain Hotlist feed
DomainTools - Feed - Domain Risk	Reports	Retrieves results from the real-time Domain Risk feed of apex-level domain risk scores, regardless of observed traffic. Default cron_schedule = */5 * * * *.	Optional: required for the Domain Risk feed	Domain Risk feed
DomainTools - Feed - NAD	Reports	Retrieves results from the real-time Newly Active Domains feed. Default cron_schedule = */5 * * * *.	Optional: required for the Newly Active Domains feed	Newly Active Domains feed
DomainTools - Feed - NOD	Reports	Retrieves results from the real-time Newly Observed Domains feed. Default cron_schedule = */5 * * * *.	Optional: required for the Newly Observed Domains feed	Newly Observed Domains feed
DomainTools - Feed - NOH	Reports	Retrieves results from the real-time Newly Observed Hostnames feed. Default cron_schedule = */5 * * * *.	Optional: required for the Newly Observed Hostnames feed	Newly Observed Hostnames feed
DomainTools - Feed - RDAP	Reports	Retrieves results from the real-time Parsed Domain RDAP feed. Default cron_schedule = */5 * * * *.	Optional: required for the Parsed Domain RDAP feed	Parsed Domain RDAP feed
DomainTools - Import Iris Detect Monitors	Reports	Imports configured monitors from Iris Detect into the dt_iris_detect_monitors collection. Default cron_schedule = 0 0 * * *.	Optional: required for Iris Detect	Iris Detect
DomainTools - Import Iris Detect Results	Reports	Imports newly discovered domains for the monitors enabled in the app. Default cron_schedule = 45 */2 * * *.	Optional: required for Iris Detect	Iris Detect
DomainTools - Iris Enrich History	Reports	Saves historical Iris Enrich results to dt_enrich_history. Default cron_schedule = 10 * * * *.	Optional: required for enrichment history	Core App
DomainTools - Iris Enrich Monitored Domains	Reports	Refreshes enrichment data for monitored domains on the configured frequency. Default cron_schedule = 0 0 * * *.	Required to enrich monitored domains on a cron schedule	Core App
DomainTools - Iris Enrich Monitored Domains Live	Reports	Refreshes enrichment data for Iris Enrich monitored domains whenever your network sees them. Default cron_schedule = */5 * * * *.	Required to enrich monitored domains as the base search sees them	Core App
DomainTools - Iris Enrichment	Reports	Enriches domains in dt_iris_enrich_queue and stores results in dt_iris_enrich_data. Runs every 5 minutes over the past 30 minutes by default. Default cron_schedule = */5 * * * *.	Required for Iris enrichment	Core App
DomainTools - Queue Builder for Iris Enrich KV Store	Reports	Extracts domains from raw events based on your base search and stores them in the dt_iris_enrich_queue KV store. Default cron_schedule = */2 * * * *.	Required for Iris enrichment	Core App
DomainTools - Summary - Timechart count by domain with latest time	Reports	Summarizes base search events when the selected time window is greater than 2 hours in any dashboard. Default cron_schedule = 5 * * * *.	Required for dashboard views of 4h or more	Core App
DomainTools - Sync Iris Detect Watchlist	Reports	Syncs the Iris Detect Watchlist with the Splunk Monitoring List. Default cron_schedule = 0 0 * * *.	Required for Iris Detect	Iris Detect

Note

The app works with Queue Builder for Iris Enrich KV Store and Iris Enrichment disabled, but won’t automatically enrich events. Some customers disable these when building their own enrichment pipelines and use the app for ad hoc search or monitoring only.

Caution

Before enabling any DomainTools - Feed - * saved search, create the Splunk index it writes to. If the index doesn’t exist, the feed runs but silently drops its results. See Create the required indexes.

Alerts

Splunk Enterprise Security (ES) generates notifications as notable events. For Splunk without ES, the app generates alerts through the dt_alerts index. Configure the criteria for both on the Configure Enrichment & Alerting page, then enable the corresponding alert saved searches in the table below.

Alert saved searches

Enable these alerts to create notable events from the criteria set in DT Settings → Configure Enrichment & Alerting:

Name	Type	Description	Required
DomainTools - DomainTools Domain Monitoring - Rule	Alert	Creates events based on enrichment and alerting configuration. To create notable events in Enterprise Security, enable this saved search or the ES correlation search. Default cron_schedule = */30 * * * *.	Required for alerting at configured thresholds without the Splunk ES correlation search.
DomainTools - DomainTools Iris Detect - Rule	Alert	Creates events based on enrichment and alerting configuration. Default cron_schedule = 15 * * * *.	Required for alerting at configured thresholds without the Splunk ES correlation search.
DomainTools - DomainTools Risk Score Increase - Rule	Alert	Creates alerts for Risk Score increases over a 7-day window. Default cron_schedule = 15 * * * *.	Required for alerting at configured thresholds without the Splunk ES correlation search.
DomainTools - DomainTools Young Domains - Rule	Alert	Creates events based on enrichment and alerting configuration. Default cron_schedule = */30 * * * *.	Required for alerting at configured thresholds without the Splunk ES correlation search.

Configure Enrichment & Alerting

This page controls enrichment timing and caching, the thresholds the app uses throughout dashboards and alerting, and the alert criteria the app evaluates. The page is organized into four groups: Enrichment Settings, Cache Settings, the threshold settings, and Alert Settings. Select Save to apply changes in any group.

Enrichment Settings

• Queue Wait Time (default: 5 minutes): How often the app enriches domain information. Choose from the preset intervals (Every Minute, Every 5 Minutes, Every 10 Minutes, Every 20 Minutes, Every 30 Minutes). Decreasing the frequency can reduce API usage, or help if enrichment takes longer than 5 minutes to run on a higher-volume Splunk cluster.

Cache Settings

The app maintains a cache to reduce API query usage. Disable it or reduce the retention period when you’re monitoring highly volatile domains.

• Enable Cache (default: enabled): Optimizes API consumption. When off, the app ignores past domain intelligence and makes API calls for every domain found in your log sources.
• Cache Retention Period (minimum 1, maximum 365, default 30 days): Sets how long domain enrichment lives in the cache before the app re-queries it.

Caution

Turning off the cache can result in high API consumption. A large cache retention period can consume additional storage on the search head.

Thresholds

These thresholds define dashboard KPIs and alerting criteria (if enabled) across the app. For the risk-based settings, a higher value is a more restrictive filter. See the Domain Risk Score User Guide to interpret risk scores.

Under DomainTools Threshold Settings:

• Suspicious Risk Score Threshold (minimum 0, maximum 100, default 75): The DomainTools Overall Risk Score used to define a “suspicious” domain throughout the app.
• Threat Profile Score Threshold (minimum 0, maximum 100, default 85): The threshold for DomainTools ML-based Threat Profile scoring, which covers Phishing, Spam, and Malware.
• Proximity Score Threshold (minimum 0, maximum 100, default 65): The threshold for DomainTools Proximity score, which measures how closely connected a domain is to other known-bad domains.
• Young Domain Age (minimum 1, default 7 days): The age threshold, in days, for a domain to be flagged as young in dashboards and optionally alerting. Newly registered domains are often an indicator of interest.
• Guided Pivot Threshold (minimum 1, maximum 5000, default 500): When a small set of domains shares an attribute (for example, a registrar), that attribute can be pivoted on to find other similar domains. The app highlights an attribute for further investigation when the number of domains sharing it is below this threshold. Set a lower value to narrow investigations.
• Risk Score Increase Alert Threshold (minimum 1, maximum 100, default 50): The change in risk score that results in a new alert.

Under Risky Observed Domains Threshold Settings, which set the risk bands in the Risky Observed Domains graph on the Threat Intelligence Dashboard (higher risk scores indicate riskier domains):

• High Risk Threshold (minimum 1, maximum 99, default 90): Minimum Risk Score to flag a domain as High Risk in the graph.
• Medium Risk Threshold (minimum 0, default 70): Minimum Risk Score to flag a domain as Medium Risk in the graph. The maximum must be less than the High Risk Threshold.

Alert Settings

Customers with access to Splunk Enterprise Security can create a notable event when certain criteria are met. Select Create Alerts to let the app generate alerts; this applies to both Enterprise Security notable events and the dt_alerts index. Leave it unchecked if you don’t want the app to generate alerts. When checked, the app evaluates the criteria in the four monitor panels below. Each panel sets its own Urgency Tag for Notable Event (INFORMATIONAL, LOW, MEDIUM, HIGH (default), or Critical), which specifies the urgency level shown in the Enterprise Security Incident Review dashboard. Criteria that reference a threshold use the values configured under Threshold Settings.

DomainTools: Monitor Domains

• Only Monitor Domains In DomainTools Monitoring list (default): An alert fires only against domains that exist in the monitoring list.
• Exceeds Domain Risk Score Threshold: Alert only if the domain exceeds the Suspicious Risk Score Threshold.
• Exceeds Domain Threat Profile Score Threshold: Alert only if the domain exceeds the Threat Profile Score Threshold.
• Ignore Iris Detect Domains in DomainTools Monitoring list: Ignore anything in the monitoring list whose Source is “Iris Detect”.
• Monitor DomainTools Iris Tags in Tag Monitoring List: Alert when new domains observed in your environment match any Iris tags specified on the Manage Monitored Tags page.

DomainTools: Monitor Young Domain

• Younger than Domain Age Threshold (default): Triggers an alert if the domain age is younger than the Young Domain Age threshold.
• Only Monitor Domains In DomainTools Monitoring List: Optionally restricts young-domain alerts to new domains on the monitoring list. Useful with Iris Detect monitors that track newly registered domains.

DomainTools: Monitor Risk Score Increase

• Increase in domain risk score (default): Triggers an alert if the domain risk score increases.
• Exceeds Domain Risk Score Threshold (default): Alert only if the domain exceeds the Suspicious Risk Score Threshold.
• Exceeds Risk Score Increase Alert Threshold (default): Triggers an alert if the risk score increase exceeds the Risk Score Increase Alert Threshold.

DomainTools: Iris Detect

• Monitored Detect Domains (default): Triggers an alert if an event matches a domain from Iris Detect results that’s been added to Monitored Domains.

Notable events (Splunk Enterprise Security)

To create notable events, select Create Alerts under Alert Settings, choose the criteria in the monitor panels, and set an Urgency Tag for Notable Event for each panel. Then enable either the DomainTools - DomainTools Domain Monitoring - Rule saved search or the Enterprise Security correlation search, as described in Alerts.

Alerts (Splunk without Enterprise Security)

Without ES, the app generates notifications through the dt_alerts and dt_enrich_history indexes. You must create these indexes before enabling the alert saved searches, or the alerts are silently dropped. See Create the required indexes in advanced configuration.

Enrichment history

The app supports enrichment history through the custom dt_enrich_history index, which stores all Iris Enrich values for every domain. When a domain is re-enriched, the index records the new values, so you can compare changes across WHOIS info, IPs, SSL fields, risk scores, and other indicators. This index isn’t created by the app — create it as described in Create the required indexes.

Diagnostic Panel

Logging is off by default. To enable it for diagnostics, go to DT Settings → Diagnostic Panel and select Enable Diagnostic Panel. Allow a few minutes for logs to populate, then refresh the page.

The panel shows the connection status of each DomainTools service — Iris Enrich, Iris Investigate, Iris Detect, and Account Information — followed by two log tables:

• DomainTools Logs: The app’s own log output. Filter by Log Level (Error, Warning, Info, Debug).
• Splunk’s Saved Search Logs: Scheduler results for the app’s saved searches, including columns for Time, Savedsearch Name, Status, Result Count, Run Time (s), Reason, and Search ID. Statuses include Success and Skipped.

Related resources

• Advanced configuration — create the required indexes, enable threat feeds, and enable the Parsed Domain RDAP API
• Iris Enrich — dashboards and monitored domains and tags
• Iris Detect — Iris Detect results and monitored terms
• Search — run custom search commands and query threat feed indexes
• Configuration tables and troubleshooting — configuration files, KV store names, and troubleshooting