Splunk Enterprise app search

The Search page is the standard Splunk Search Processing Language (SPL) interface. In the DomainTools App, you use it to run the custom search commands that call DomainTools APIs and to query the threat feed indexes you enable in advanced configuration.

Custom search commands

DomainTools custom search commands extend SPL with enrichment, investigation, passive DNS, WHOIS history, and RDAP lookups. Each command is a generating or transforming command that you pipe into a search. The commands below run against the DomainTools APIs and return results into your search pipeline.

Several commands also power dedicated UI pages: the DNSDB commands back Farsight DNSDB, dtwhoishistory backs WHOIS history, and dtparseddomainrdap backs Domain RDAP. The utility commands dtaccountinfo and dtidnadecode support the app’s internal pages. The threat feed commands and Iris Detect commands are grouped in their own sections below.

dtdomainextract

Extracts a domain from a URL field using tldextract, so DomainTools APIs receive a valid domain as input.

• Syntax: | dtdomainextract field_in=string field_out=string include_subdomains=bool debug=bool feature=string
• Parameters:
  • field_in (required)
  • field_out (required)
  • include_subdomains (optional)
  • debug (optional)
  • feature (optional)
• Example: ... | dtdomainextract field_in=url field_out=domain

dtirisenrich

Queries Iris Enrich for up to 100 comma-separated domains. Set inline_results=true to keep the event data inline with your results.

• Syntax: | dtirisenrich domain=string inline_results=string feature=string
• Parameters:
  • domain (required)
  • inline_results (optional)
  • feature (optional)
• Example: | makeresults | eval domain="domaintools.com" | dtirisenrich domain=domain inline_results=true

dtirisinvestigate

Queries Iris Investigate for up to 100 domains, or pivots on a domain attribute to find related infrastructure. You must provide either irisql, domain, or pivot_type and pivot_value. Providing multiple will only display one result, with priority going to irisql followed by domain. Review Query with IrisQL for formatting instructions.

• Syntax: | dtirisinvestigate irisql=string domain=string pivot_type=string pivot_value=string feature=string no_cache=bool
• Parameters:
  • irisql (optional) — a raw IrisQL query string. Must begin with the version header # IrisQL-1.0 followed by \n and the query body. Always queries live and skips the cache, independent of no_cache.
  • domain (optional)
  • pivot_type (required unless using irisql or domain)
  • pivot_value (required unless using irisql or domain)
  • feature (optional)
  • no_cache (optional)
• Domain example: | dtirisinvestigate domain="domaintools.com"
• Pivot example: | dtirisinvestigate pivot_type="ip" pivot_value="x.x.x.x"
• IrisQL example: | dtirisinvestigate irisql="# IrisQL-1.0\nDOMAIN CONTAINS \"phishing\""

dtformatinvestigate

Formats the JSON returned by Iris Investigate into a row with named components.

• Syntax: | dtformatinvestigate output=string feature=string
• Parameters:
  • output (required)
  • feature (optional)
• Example: | dtirisinvestigate domain="domaintools.com" | dtformatinvestigate output=risk

dtparseddomainrdap

Returns Parsed Domain RDAP API results for a domain. This command supports only the domain parameter. The Parsed Domain RDAP API is a lookup service, separate from the Parsed Domain RDAP Feed. Enable it under Enable the Parsed Domain RDAP API, and view results in the Domain RDAP page.

• Syntax: | dtparseddomainrdap domain=string
• Parameters:
  • domain (required)

dtdnsdb

Queries Farsight DNSDB for passive DNS information on an IP, domain, hostname, or subnet.

• Syntax: | dtdnsdb target=ip/hostname type=rdata/rrset/raw rrtype=a/aaa/cname/etc time_first_before=time time_first_after=time time_last_before=time time_last_after=time target_type=auto/ip/name bailiwick=bailiwick
• Parameters:
  • target (required)
  • type (required)
  • rrtype (required)
  • bailiwick (optional)
  • time_first_before (optional)
  • time_first_after (optional)
  • time_last_before (optional)
  • time_last_after (optional)
  • target_type (optional)
• Example: | dtdnsdb target=domaintools.com target_type=domain type=rdata rrtype=CNAME

dtdnsdbflex

Performs a Farsight DNSDB passive DNS flexible search.

• Syntax: | dtdnsdbflex query_type=<rdata|rrnames> match_type=<glob|regex> query=<pattern> rrtype=A/mx/cname/etc bailiwick=bailiwick time_first_before=time time_first_after=time time_last_before=time time_last_after=time
• Parameters:
  • query_type (required)
  • match_type (required)
  • query (required)
  • rrtype (required)
  • bailiwick (optional)
  • time_first_before (optional)
  • time_first_after (optional)
  • time_last_before (optional)
  • time_last_after (optional)
• Example: | dtdnsdbflex query_type=rdata match_type=regex query="[0-9]{5,6}-ledger\.com\.$"

dtdnsdblimit

Returns the DNSDB API query limit, queries remaining, and reset time.

• Syntax: | dtdnsdblimit
• Parameters: none
• Example: | dtdnsdblimit

dtdnsdbenrich

Enriches Splunk events from a query with passive DNS information from Farsight DNSDB.

• Syntax: | dtdnsdbenrich field_in=string field_type=domain/ip/raw lookup_type=rrset/rrdata max_count=int time_first_before=time time_first_after=time time_last_before=time time_last_after=time rrtype=any/A/ns/... bailiwick=string include_subdomains=bool
• Parameters:
  • field_in (required)
  • field_type (required)
  • lookup_type (required)
  • max_count (optional)
  • rrtype (optional)
  • bailiwick (optional)
  • time_first_before (optional)
  • time_first_after (optional)
  • time_last_before (optional)
  • time_last_after (optional)
  • include_subdomains (optional)
  • feature (optional)
• Example: | dtdnsdbenrich field_in=domain field_type=domain lookup_type=rrset rrtype=A include_subdomains=true time_first_after=1593070040

dtwhoishistory

Performs a WHOIS history search on a domain using the WHOIS History API endpoint. This command backs the WHOIS history page.

• Syntax: | dtwhoishistory domain=string mode=string
• Parameters:
  • domain (required)
  • mode (optional) — controls what the search returns:
    • list (default) returns the matching WHOIS history records.
    • check_existence returns only the boolean has_history_entries.
    • count returns the number of history entries.
• Example: ... | dtwhoishistory domain=domain
• Example: ... | dtwhoishistory domain=domain mode="check_existence"

dtaccountinfo

Returns the provisioned DomainTools APIs and account status for your configured credentials. Each result row carries an id field (for example, iris-enrich, iris-investigate, iris-detect-monitors), so you can filter for a specific API. The app uses this command internally to drive the API Usage and Diagnostic Panel pages.

• Syntax: | dtaccountinfo params=string feature=string
• Parameters:
  • params (optional)
  • feature (optional)
• Example: | dtaccountinfo | search id="iris-enrich" | stats count

dtidnadecode

Decodes internationalized domain names (IDNs) from Punycode into their Unicode form. Use it to add a decoded field to events before display or further processing.

• Syntax: | dtidnadecode field_in=string field_out=string feature=string
• Parameters:
  • field_in (required)
  • field_out (required)
  • feature (optional)
• Example: | `dt_basesearch` | dtidnadecode field_in=domain field_out=decoded

dtformatenrich

Formats the output returned by the Iris Enrich API into named components, the enrichment-side counterpart to dtformatinvestigate.

• Syntax: | dtformatenrich
• Parameters: none
• Example: ... | dtirisenrich domain=domain | dtformatenrich

dtexpirecache

Removes expired rows from a DomainTools KV Store cache collection. Use it to clear entries older than a set number of days from a named collection.

• Syntax: | dtexpirecache collection=string time_field=string num_days_back=int feature=string
• Parameters:
  • collection (required)
  • time_field (required)
  • num_days_back (optional)
  • feature (optional)
• Example: | dtexpirecache collection="dt_iris_enrich_queue" time_field="queued" num_days_back=1

Query with IrisQL

IrisQL is a text-based query language for the Iris Investigate API. Use the irisql parameter on dtirisinvestigate to run IrisQL queries directly from Splunk SPL, without needing to build a pivot query.

Run your first IrisQL query

| dtirisinvestigate irisql="# IrisQL-1.0\nDOMAIN CONTAINS \"phishing\""

This returns every domain in Iris Investigate that contains the word phishing. Each result row includes the domain name and the full raw JSON response from the API.

Pipe the results into dtformatinvestigate for a formatted table:

| dtirisinvestigate irisql="# IrisQL-1.0\nDOMAIN CONTAINS \"phishing\"" | dtformatinvestigate output=risk

Query string format

An IrisQL query string has two parts, separated by a newline:

IrisQL-1.0

DOMAIN CONTAINS "x"

• The # IrisQL-1.0 version header is required. A missing or malformed header returns an IrisQL header is invalid error.
• Use \n to separate the header from the query body. The app converts \n to a real newline before sending the query to the API.

Combine conditions with AND on its own \n-separated line:

| dtirisinvestigate irisql="# IrisQL-1.0\nRISK_SCORE GREATER_THAN 70\nAND\nCREATE_DATE WITHIN \"The last 30 days\""

Note

An irisql query always queries the live Iris Investigate API and bypasses the local cache, regardless of the no_cache parameter. Use irisql when you need current results — for pivot-only lookups where cached data is acceptable, use pivot_type/pivot_value instead.

For the full field and operator reference — supported fields, string/numeric/date operators, AND/OR logic, and the parsed_domain_rdap:/parsed_whois: data source prefixes — see IrisQL: Iris Query Language for API. Field names and operators are identical between the API and the Splunk command.

Example queries

Find high-risk domains registered in the last 30 days:

| dtirisinvestigate irisql="# IrisQL-1.0\nRISK_SCORE GREATER_THAN 70\nAND\nCREATE_DATE WITHIN \"The last 30 days\""

Find domains sharing a registrant email — useful when investigating a known actor’s infrastructure:

| dtirisinvestigate irisql="# IrisQL-1.0\nREGISTRANT_CONTACT_EMAIL MATCHES \"badactor@example.com\""

Find domains sharing an SSL certificate hash with a known malicious domain:

| dtirisinvestigate irisql="# IrisQL-1.0\nSSL_HASH MATCHES \"<sha1_hash>\""

Save high-risk results to a lookup for alerting:

| dtirisinvestigate irisql="# IrisQL-1.0\nRISK_SCORE GREATER_THAN 90\nAND\nCREATE_DATE WITHIN \"The last 1 day\"" | table domain _raw | outputlookup append=true dt_high_risk_domains.csv

Multi-variable pivot: attribution

Combine registration identity, hosting subnet, and certificate fingerprint in a single query to correlate infrastructure. A domain matching all three conditions is very likely part of the same actor’s infrastructure:

| dtirisinvestigate irisql="# IrisQL-1.0\nREGISTRANT_CONTACT_EMAIL MATCHES \"badactor@example.com\"\nAND\nIP CONTAINS \"192.168.\"\nAND\nSSL_HASH MATCHES \"<sha1_hash>\""

Threat feed commands

The threat feed commands are generating commands that pull recent indicators directly from the DomainTools Threat Feeds API. Each takes the same parameters. The after parameter sets how far back to pull (for example, after=-60 for the last 60 minutes); domain filters to a single apex domain; top limits the number of results; and sessionID and feature are used internally.

For enabling and searching the ingested feed indexes instead, see Threat feeds.

Common parameters for every command in this section:

• after (required)
• sessionID (required)
• domain (optional)
• top (optional)
• feature (optional)

dtfeeddomaindiscovery

New domains as they are discovered in domain registration information, observed by the DomainTools global sensor network, or reported by trusted third parties.

• Syntax: | dtfeeddomaindiscovery after=string sessionID=string domain=string top=string feature=string
• Example: | dtfeeddomaindiscovery after=-60

dtfeeddomainhotlist

High-risk, apex-level domains that the DomainTools global sensor network observes to be active within 24 hours.

• Syntax: | dtfeeddomainhotlist after=string sessionID=string domain=string top=string feature=string
• Example: | dtfeeddomainhotlist after=-60 | table timestamp domain phishing_risk malware_risk spam_risk proximity_risk overall_risk expires

dtfeeddomainrdap

Changes to global domain registration information, populated by the Registration Data Access Protocol (RDAP). Complements the 5-Minute WHOIS Feed as registries and registrars move from WHOIS to RDAP.

• Syntax: | dtfeeddomainrdap after=string sessionID=string domain=string top=string feature=string
• Example: | dtfeeddomainrdap after=-60

dtfeeddomainrisk

Real-time domain risk information for apex-level domains, regardless of observed traffic.

• Syntax: | dtfeeddomainrisk after=string sessionID=string domain=string top=string feature=string
• Example: | dtfeeddomainrisk after=-60 | table timestamp domain phishing_risk malware_risk spam_risk proximity_risk overall_risk

dtfeednad

Apex-level domains (for example, example.com but not www.example.com) that DomainTools has newly observed to be active in its DNS sensor network.

• Syntax: | dtfeednad after=string sessionID=string domain=string top=string feature=string
• Example: | dtfeednad after=-60 | table timestamp domain

dtfeednod

Apex-level domains observed for the first time by the DomainTools sensor network, and which aren’t present in the DNSDB historical database.

• Syntax: | dtfeednod after=string sessionID=string domain=string top=string feature=string
• Example: | dtfeednod after=-60 | table timestamp domain

dtfeednoh

Hostname resolutions observed for the first time by the DomainTools global DNS sensor network.

• Syntax: | dtfeednoh after=string sessionID=string domain=string top=string feature=string
• Example: | dtfeednoh after=-60 | table timestamp domain

Iris Detect commands

These commands back the app’s Iris Detect import and sync features. They run automatically as part of the app’s saved searches, but you can also run them directly.

dtimportirisdetectmonitors

Imports the Iris Detect monitors configured on your DomainTools account.

• Syntax: | dtimportirisdetectmonitors feature=string
• Parameters:
  • feature (optional)
• Example: | dtimportirisdetectmonitors

dtimportirisdetectresults

Imports the current day’s Iris Detect results for a given list of monitor IDs. Pipe in the monitor IDs from the dt_iris_detect_monitors lookup.

• Syntax: | dtimportirisdetectresults feature=string
• Parameters:
  • feature (optional)
• Example: | from inputlookup:dt_iris_detect_monitors | dtimportirisdetectresults

dtsyncirisdetectwatchlist

Syncs the dt_iris_detect_results entries with the state watched into the dt_monitoring_list, keeping the Iris Detect watchlist aligned with your monitored domains.

• Syntax: | dtsyncirisdetectwatchlist
• Parameters: none
• Example: | dtsyncirisdetectwatchlist

Example searches

Set up a recurring search with an Iris Investigate search hash

This example uses dtirisinvestigate to look up domains matching a search hash, parse the first-seen value into a table, and collect the results into a summary index. Save it as a report to run on a schedule.

| dtirisinvestigate pivot_type=search_hash pivot_value=YOUR_SEARCH_HASH no_cache=true
| eval json = replace(_raw, "^[^\{]+", "")
| spath input=json path=first_seen.value
| rename first_seen.value as first_seen
| table first_seen domain
| collect index=summary_index_icloud

For how to schedule a report, see the Splunk Reporting Manual.

Set up a recurring search with a DNSDB flexible search

This example uses dtdnsdbflex to look up domains matching a regular expression, last observed in DomainTools’ DNS sensor network over the past 30 days. Storing a relative Unix timestamp in a variable creates a relative time fence, so the window shifts with the schedule when you save this as a report.

| eval thirty_days_ago=relative_time(now(), "-30d@d")
| eval thirty_days_ago_unix=thirty_days_ago
| dtdnsdbflex query_type=rrnames match_type=regex query="-icloud\.(net|com)\.$" rrtype=A time_last_after=thirty_days_ago_unix

For how to write regular expressions for the DNSDB flexible search, see the regular expression user guide.

Threat feeds

Each feed saved search you enable in Enable threat feeds writes its results into a dedicated Splunk index that you create. Query that index directly from the Search page. The index names are fixed by the app:

Feed	Index
Domain Discovery	dt_feed_domain_discovery
Domain Hotlist	dt_feed_domain_hotlist
Domain Risk	dt_feed_domainrisk
Newly Active Domains (NAD)	dt_feed_nad
Newly Observed Domains (NOD)	dt_feed_nod
Newly Observed Hostnames (NOH)	dt_feed_noh
Parsed Domain RDAP	dt_feed_rdap

Every feed event carries a domain and a timestamp. The Domain Risk and Domain Hotlist feeds also carry the per-category risk scores (phishing_risk, malware_risk, spam_risk, proximity_risk, overall_risk), and Domain Hotlist adds expires.

View the 100 most recent domains from a feed:

index=dt_feed_nod
| sort - _time
| head 100
| table _time, domain

Check whether a specific domain appeared in a feed:

index=dt_feed_nod domain="example.com"

Find domains containing a keyword — useful for hunting a brand or term:

index=dt_feed_nod domain="*microsoft*"

Review the highest-risk domains from the Domain Risk feed:

index=dt_feed_domainrisk
| sort - overall_risk
| table _time, domain, overall_risk, phishing_risk, malware_risk, spam_risk, proximity_risk

For threat feed parameter details, see Threat feed parameters.

Related resources

• DT Settings — enable saved searches and configure enrichment and alerting
• Advanced configuration — create feed indexes, enable threat feeds, and enable the Parsed Domain RDAP API
• Farsight DNSDB — the passive DNS search UI page
• WHOIS history — the WHOIS history UI page
• Domain RDAP — the Parsed Domain RDAP lookup UI page
• Configuration tables and troubleshooting — configuration file and KV store reference