Splunk SOAR app actions reference

This page documents all supported actions for the DomainTools App for Splunk SOAR.

Supported Actions

The following actions are supported:

• Test Connectivity - Validate the asset configuration for connectivity
• Domain Reputation - Evaluate the risk of a given domain
• Pivot Action - Find domains connected by any supported Iris Investigate search parameter
• Reverse Domain - Extract IPs from a single domain response for further pivoting
• Reverse IP - Find domains with web hosting IP, NS IP or MX IP
• Load Hash - Load or monitor Iris Investigate search results by Iris Investigate export hash
• Reverse Email - Find domains with email in WHOIS, DNS SOA or SSL certificate
• Lookup Domain - Get all Iris Investigate data for a domain using the Iris Investigate API endpoint (required)
• Enrich Domain - Get all Iris Investigate data for a domain except counts using the high volume Iris Enrich API endpoint (if provisioned)
• Configure Scheduled Playbooks - Run on initial setup to configure the optional monitoring playbooks
• On Poll - Execute scheduled playbooks based on the set interval in domaintools_scheduled_playbooks custom list
• Parsed Domain RDAP - Return the most recent Domain-RDAP registration record for a domain
• NOD Feed - Retrieve apex-level domains observed for the first time, not present in DNSDB
• NAD Feed - Retrieve apex-level domains newly observed in the DNS sensor network
• NOH Feed - Retrieve fully qualified domain names never seen before in passive DNS
• Domain Discovery Feed - Retrieve new domains discovered via registration, sensor network, or third parties
• Domain RDAP Feed - Retrieve RDAP registration records for domains
• Domain Risk Feed - Retrieve real-time updates to Domain Risk Scores for apex domains
• Domain Hotlist Feed - Retrieve high-risk domains active within the last 24 hours
• Iris Detect Get New Domains - Retrieve newly discovered domains from Iris Detect across all monitors
• Iris Detect Get Watched Domains - Retrieve watched domains from Iris Detect across all monitors
• Iris Detect Get Ignored Domains - Retrieve ignored (false positive) domains from Iris Detect
• Iris Detect Get Escalated Domains - Retrieve domains escalated to Google Safe Browsing from Iris Detect
• Iris Detect Get Blocklist Domains - Retrieve domains escalated for internal blocking from Iris Detect
• Iris Detect Get Monitors List - Retrieve the list of monitors configured in Iris Detect
• Iris Detect Escalate Domains - Escalate one or more watched domains to Google Safe Browsing
• Iris Detect Blocklist Domains - Escalate one or more watched domains for internal blocking
• Iris Detect Watch Domains - Add one or more domains to the Iris Detect watchlist
• Iris Detect Ignore Domains - Mark one or more domains as ignored in Iris Detect

Test Connectivity

Validate the asset configuration for connectivity.

Type: test Read only: True

Action Parameters

This action requires no parameters.

Action Output

No Output

Domain Reputation

Evaluate the risk of a given domain.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
domain	required	Domain or comma-separated list of domains to query	string	url domain

Action Output

Data Path	Type	Contains	Example Values
action_result.parameter.domain	string	url domain
action_result.data	string
action_result.status	string		success failed
action_result.message	string
action_result.summary.domain_risk	numeric
action_result.summary.zerolisted	boolean		True False
action_result.summary.proximity	numeric
action_result.summary.threat_profile	numeric
action_result.summary.threat_profile_malware	numeric
action_result.summary.threat_profile_phishing	numeric
action_result.summary.threat_profile_spam	numeric
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Pivot Action

Find domains connected by any supported Iris Investigate search parameter.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
query_value	required	Value to query	string	url domain ip email
pivot_type	required	Field to pivot on	string
status	optional	Return domains of this registration type	string
data_updated_after	optional	Iris Investigate records that were updated on or after midnight on this date, in YYYY-MM-DD format or relative options ( ‘today’, ‘yesterday’ )	string
tld	optional	Limit results to only include domains in a specific top-level domain (i.e. “tld=com” or “tld=ru”)	string
create_date	optional	Only include domains created on a specific date, in YYYY-MM-DD format or relative options ( ‘today’, ‘yesterday’ )	string
create_date_within	optional	Only include domains with a whois create date within the specified number of days (e.g. specifying ‘1’ would indicate within the past day)	string
first_seen_within	optional	Only include domains with a current lifecycle first observed within the specified number of seconds (e.g. specifying ‘86400’ would indicate within the past day)	string
first_seen_since	optional	Only include domains with a current lifecycle first observed since a specified datetime. (Example: 2023-04-10T00:00:00+00:00)	string
expiration_date	optional	Only include domains expiring on a specific date, in YYYY-MM-DD format or relative options ( ‘today’, ‘yesterday’ )	string

Action Output

Data Path	Type	Contains	Example Values
action_result.parameter.create_date	string
action_result.parameter.create_date_within	string
action_result.parameter.data_updated_after	string
action_result.parameter.first_seen_within	string
action_result.parameter.first_seen_since	string
action_result.parameter.expiration_date	string
action_result.data.*.first_seen.count	numeric
action_result.data.*.first_seen.value	string
action_result.data.*.server_type.count	numeric
action_result.data.*.server_type.value	string
action_result.data.*.website_title.count	numeric
action_result.data.*.website_title.value	string
action_result.parameter.pivot_type	string
action_result.parameter.query_value	string	url domain ip email
action_result.parameter.status	string
action_result.parameter.tld	string
action_result.data.*.domain	string	domain
action_result.data.*.domain_risk.risk_score	numeric
action_result.data.*.domain_risk.risk_score_string	string
action_result.status	string		success failed
action_result.message	string
action_result.summary	string
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Reverse Domain

Extract IPs from a single domain response for further pivoting.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
domain	required	Domain or comma-separated list of domains to query	string	url domain

Action Output

Data Path	Type	Contains	Example Values
action_result.parameter.domain	string	url domain
action_result.data	string
action_result.data.*.first_seen.count	numeric
action_result.data.*.first_seen.value	string
action_result.data.*.server_type.count	numeric
action_result.data.*.server_type.value	string
action_result.data.*.website_title.count	numeric
action_result.data.*.website_title.value	string
action_result.status	string		success failed
action_result.message	string
action_result.summary.ip_list.*.count	numeric
action_result.summary.ip_list.*.count_string	string
action_result.summary.ip_list.*.ip	string	ip
action_result.summary.ip_list.*.type	string
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Reverse IP

Find domains with web hosting IP, NS IP or MX IP.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
ip	required	IP address to query	string	ip
status	optional	Return domains of this registration type	string
data_updated_after	optional	Iris Investigate records that were updated on or after midnight on this date, in YYYY-MM-DD format or relative options ( ‘today’, ‘yesterday’ )	string
tld	optional	Limit results to only include domains in a specific top-level domain (i.e. “tld=com” or “tld=ru”)	string
create_date	optional	Only include domains created on a specific date, in YYYY-MM-DD format or relative options ( ‘today’, ‘yesterday’ )	string
create_date_within	optional	Only include domains with a whois create date within the specified number of days (e.g. specifying ‘1’ would indicate within the past day)	string
first_seen_within	optional	Only include domains with a current lifecycle first observed within the specified number of seconds (e.g. specifying ‘86400’ would indicate within the past day)	string
first_seen_since	optional	Only include domains with a current lifecycle first observed since a specified datetime. (Example: 2023-04-10T00:00:00+00:00)	string
expiration_date	optional	Only include domains expiring on a specific date, in YYYY-MM-DD format or relative options ( ‘today’, ‘yesterday’ )	string

Action Output

Data Path	Type	Contains	Example Values
action_result.parameter.create_date	string
action_result.parameter.create_date_within	string
action_result.parameter.data_updated_after	string
action_result.parameter.expiration_date	string
action_result.parameter.first_seen_within	string
action_result.parameter.first_seen_since	string
action_result.parameter.ip	string	ip
action_result.parameter.status	string
action_result.parameter.tld	string
action_result.data.*.domain	string	domain
action_result.data.*.domain_risk.risk_score	numeric
action_result.data.*.domain_risk.risk_score_string	string
action_result.status	string		success failed
action_result.message	string
action_result.summary	string
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Load Hash

Load or monitor Iris Investigate search results by Iris Investigate export hash.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
search_hash	required	Paste the “Current Search Export” string (Advanced -> Import/Export Search) from Iris Investigate in this field to import up to 5000 domains	string

Action Output

Data Path	Type	Contains	Example Values
action_result.parameter.search_hash	string
action_result.data.*.domain	string	domain
action_result.data.*.domain_risk.risk_score	numeric
action_result.data.*.domain_risk.risk_score_string	string
action_result.status	string		success failed
action_result.message	string
action_result.summary	string
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Reverse Email

Find domains with email in Whois, DNS SOA or SSL certificate.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
email	required	Email query	string	email
status	optional	Return domains of this registration type	string
data_updated_after	optional	Iris Investigate records that were updated on or after midnight on this date, in YYYY-MM-DD format or relative options ( ‘today’, ‘yesterday’ )	string
tld	optional	Limit results to only include domains in a specific top-level domain (i.e. “tld=com” or “tld=ru”)	string
create_date	optional	Only include domains created on a specific date, in YYYY-MM-DD format or relative options ( ‘today’, ‘yesterday’ )	string
create_date_within	optional	Only include domains with a whois create date within the specified number of days (e.g. specifying ‘1’ would indicate within the past day)	string
first_seen_within	optional	Only include domains with a current lifecycle first observed within the specified number of seconds (e.g. specifying ‘86400’ would indicate within the past day)	string
first_seen_since	optional	Only include domains with a current lifecycle first observed since a specified datetime. (Example: 2023-04-10T00:00:00+00:00)	string
expiration_date	optional	Only include domains expiring on a specific date, in YYYY-MM-DD format or relative options ( ‘today’, ‘yesterday’ )	string

Action Output

Data Path	Type	Contains	Example Values
action_result.parameter.create_date	string
action_result.parameter.create_date_within	string
action_result.parameter.data_updated_after	string
action_result.parameter.email	string	email
action_result.parameter.expiration_date	string
action_result.parameter.first_seen_within	string
action_result.parameter.first_seen_since	string
action_result.parameter.status	string
action_result.parameter.tld	string
action_result.data.*.domain	string	domain
action_result.data.*.domain_risk.risk_score	numeric
action_result.data.*.domain_risk.risk_score_string	string
action_result.data.*.first_seen.count	numeric
action_result.data.*.first_seen.value	string
action_result.data.*.server_type.count	numeric
action_result.data.*.server_type.value	string
action_result.data.*.website_title.count	numeric
action_result.data.*.website_title.value	string
action_result.status	string		success failed
action_result.message	string
action_result.summary	string
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Parsed Domain RDAP

The Parsed Domain RDAP API returns the most recent Domain-RDAP registration record. This action complements the WHOIS-based lookups: some registries and registrars support RDAP as an alternative to WHOIS for providing domain registration data.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
domain	optional	The domain name to query (for example, example.com)	string

Action Output

Data Path	Type	Contains	Example Values
action_result.data	string
action_result.data.*.domain	string	domain
action_result.data.*.domain_statuses	string
action_result.data.*.creation_date	string
action_result.data.*.last_changed_date	string
action_result.data.*.expiration_date	string
action_result.data.*.dnssec.signed	boolean
action_result.data.*.nameservers	string
action_result.data.*.conformance	string
action_result.data.*.emails	string
action_result.data.*.email_domains	string
action_result.data.*.unclassified_emails	string
action_result.data.*.registrar_name	string
action_result.data.*.registrar_iana_id	string
action_result.data.*.registrar_contacts_name	string
action_result.data.*.registrar_contacts_email	string
action_result.data.*.registrar_contacts_phone	string
action_result.data.*.registrar_contacts_roles	string
action_result.data.*.contact_name_1	string
action_result.data.*.contact_org_1	string
action_result.data.*.contact_email_1	string
action_result.data.*.contact_phone_1	string
action_result.data.*.contact_street_1	string
action_result.data.*.contact_city_1	string
action_result.data.*.contact_postal_1	string
action_result.data.*.contact_region_1	string
action_result.data.*.contact_country_1	string
action_result.data.*.contact_roles_1	string
action_result.data.*.contact_name_2	string
action_result.data.*.contact_org_2	string
action_result.data.*.contact_email_2	string
action_result.data.*.contact_phone_2	string
action_result.data.*.contact_street_2	string
action_result.data.*.contact_city_2	string
action_result.data.*.contact_postal_2	string
action_result.data.*.contact_region_2	string
action_result.data.*.contact_country_2	string
action_result.data.*.contact_roles_2	string
action_result.data.*.contact_name_3	string
action_result.data.*.contact_org_3	string
action_result.data.*.contact_email_3	string
action_result.data.*.contact_phone_3	string
action_result.data.*.contact_street_3	string
action_result.data.*.contact_city_3	string
action_result.data.*.contact_postal_3	string
action_result.data.*.contact_region_3	string
action_result.data.*.contact_country_3	string
action_result.data.*.contact_roles_3	string
action_result.status	string		success failed
action_result.summary	string
action_result.message	string
action_result.parameter.domain	string
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

NOD Feed

Apex-level domains observed for the first time by the DomainTools sensor network, and not present in the DNSDB historical database.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
domain	optional	Filter by exact domain or partial match (prefix or suffix with *)	string
before	optional	End of the query window, in seconds or ISO 8601 format, relative to current time, inclusive	string
after	optional	Start of the query window, in seconds or ISO 8601 format, relative to current time, inclusive	string
session_id	optional	Unique identifier for the session; resumes retrieval from the last recorded timestamp	string
top	optional	Maximum number of results to return	string

Action Output

Data Path	Type	Contains	Example Values
action_result.data	string
action_result.data.*.domain	string	domain
action_result.data.*.timestamp	string
action_result.status	string		success failed
action_result.summary	string
action_result.message	string
action_result.parameter.after	string
action_result.parameter.before	string
action_result.parameter.domain	string
action_result.parameter.session_id	string
action_result.parameter.top	string
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

NAD Feed

Apex-level domains newly observed in the DomainTools DNS sensor network. Includes domains observed in DNS for the first time, and domains re-observed after at least 10 days of inactivity.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
domain	optional	Filter by exact domain or partial match (prefix or suffix with *)	string
before	optional	End of the query window, in seconds or ISO 8601 format, relative to current time, inclusive	string
after	optional	Start of the query window, in seconds or ISO 8601 format, relative to current time, inclusive	string
session_id	optional	Unique identifier for the session; resumes retrieval from the last recorded timestamp	string
top	optional	Maximum number of results to return	string

Action Output

Data Path	Type	Contains	Example Values
action_result.data	string
action_result.data.*.domain	string	domain
action_result.data.*.timestamp	string
action_result.status	string		success failed
action_result.summary	string
action_result.message	string
action_result.parameter.after	string
action_result.parameter.before	string
action_result.parameter.domain	string
action_result.parameter.session_id	string
action_result.parameter.top	string
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

NOH Feed

Fully qualified domain names never seen before in passive DNS, emitted as soon as they are first observed by the DomainTools global DNS sensor network.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
domain	optional	Filter by exact domain or partial match (prefix or suffix with *)	string
before	optional	End of the query window, in seconds or ISO 8601 format, relative to current time, inclusive	string
after	optional	Start of the query window, in seconds or ISO 8601 format, relative to current time, inclusive	string
session_id	optional	Unique identifier for the session; resumes retrieval from the last recorded timestamp	string
top	optional	Maximum number of results to return	string

Action Output

Data Path	Type	Contains	Example Values
action_result.data	string
action_result.data.*.domain	string	domain
action_result.data.*.timestamp	string
action_result.status	string		success failed
action_result.summary	string
action_result.message	string
action_result.parameter.after	string
action_result.parameter.before	string
action_result.parameter.domain	string
action_result.parameter.session_id	string
action_result.parameter.top	string
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Domain Discovery Feed

New domains as they are discovered in domain registration information, observed by the DomainTools global sensor network, or reported by trusted third parties.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
domain	optional	Filter by exact domain or partial match (prefix or suffix with *)	string
before	optional	End of the query window, in seconds or ISO 8601 format, relative to current time, inclusive	string
after	optional	Start of the query window, in seconds or ISO 8601 format, relative to current time, inclusive	string
session_id	optional	Unique identifier for the session; resumes retrieval from the last recorded timestamp	string
top	optional	Maximum number of results to return	string

Action Output

Data Path	Type	Contains	Example Values
action_result.data	string
action_result.data.*.domain	string	domain
action_result.data.*.timestamp	string
action_result.status	string		success failed
action_result.summary	string
action_result.message	string
action_result.parameter.after	string
action_result.parameter.before	string
action_result.parameter.domain	string
action_result.parameter.session_id	string
action_result.parameter.top	string
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Domain RDAP Feed

RDAP registration records for domains. When a domain has records from both a registry and a registrar, the response combines both sets of results.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
domain	optional	Filter by exact domain or partial match (prefix or suffix with *)	string
before	optional	End of the query window, in seconds or ISO 8601 format, relative to current time, inclusive	string
after	optional	Start of the query window, in seconds or ISO 8601 format, relative to current time, inclusive	string
session_id	optional	Unique identifier for the session; resumes retrieval from the last recorded timestamp	string
top	optional	Maximum number of results to return	string

Action Output

Data Path	Type	Contains	Example Values
action_result.data	string
action_result.data.*.domain	string	domain
action_result.data.*.timestamp	string
action_result.data.*.parsed_record.parsed_fields	string
action_result.status	string		success failed
action_result.summary	string
action_result.message	string
action_result.parameter.after	string
action_result.parameter.before	string
action_result.parameter.domain	string
action_result.parameter.session_id	string
action_result.parameter.top	string
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Domain Risk Feed

Real-time updates to Domain Risk Scores for apex domains, regardless of observed traffic.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
domain	optional	Filter by exact domain or partial match (prefix or suffix with *)	string
before	optional	End of the query window, in seconds or ISO 8601 format, relative to current time, inclusive	string
after	optional	Start of the query window, in seconds or ISO 8601 format, relative to current time, inclusive	string
session_id	optional	Unique identifier for the session; resumes retrieval from the last recorded timestamp	string
top	optional	Maximum number of results to return	string

Action Output

Data Path	Type	Contains	Example Values
action_result.data	string
action_result.data.*.domain	string	domain
action_result.data.*.timestamp	string
action_result.data.*.phishing_risk	string
action_result.data.*.malware_risk	string
action_result.data.*.spam_risk	string
action_result.data.*.proximity_risk	string
action_result.data.*.overall_risk	string
action_result.status	string		success failed
action_result.summary	string
action_result.message	string
action_result.parameter.after	string
action_result.parameter.before	string
action_result.parameter.domain	string
action_result.parameter.session_id	string
action_result.parameter.top	string
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Domain Hotlist Feed

Domains with high Domain Risk Scores that have also been active within 24 hours.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
domain	optional	Filter by exact domain or partial match (prefix or suffix with *)	string
before	optional	End of the query window, in seconds or ISO 8601 format, relative to current time, inclusive	string
after	optional	Start of the query window, in seconds or ISO 8601 format, relative to current time, inclusive	string
session_id	optional	Unique identifier for the session; resumes retrieval from the last recorded timestamp	string
top	optional	Maximum number of results to return	string

Action Output

Data Path	Type	Contains	Example Values
action_result.data	string
action_result.data.*.domain	string	domain
action_result.data.*.timestamp	string
action_result.data.*.phishing_risk	string
action_result.data.*.malware_risk	string
action_result.data.*.spam_risk	string
action_result.data.*.proximity_risk	string
action_result.data.*.overall_risk	string
action_result.data.*.expires	string
action_result.status	string		success failed
action_result.summary	string
action_result.message	string
action_result.parameter.after	string
action_result.parameter.before	string
action_result.parameter.domain	string
action_result.parameter.session_id	string
action_result.parameter.top	string
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Lookup Domain

Get all Iris Investigate data for a domain using the Iris Investigate API endpoint (required).

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
domain	required	Domain or comma-separated list of domains to query using the Iris Investigate API	string	url domain

Action Output

Data Path	Type	Contains	Example Values
action_result.status	string		failed success
action_result.parameter.domain	string	url domain
action_result.message	string
action_result.summary	string
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

The action_result.data.* fields are grouped by category below. Each field includes a .count (numeric) and .value (string) pair unless otherwise noted.

WHOIS contact fields

Admin contact — action_result.data.*.admin_contact.*

Field	Type
city.count / city.value	numeric / string
country.count / country.value	numeric / string
fax.count / fax.value	numeric / string
name.count / name.value	numeric / string
org.count / org.value	numeric / string
phone.count / phone.value	numeric / string
postal.count / postal.value	numeric / string
state.count / state.value	numeric / string
street.count / street.value	numeric / string

Billing contact — action_result.data.*.billing_contact.*

Same fields as admin contact: city, country, fax, name, org, phone, postal, state, street (each with .count and .value).

Registrant contact — action_result.data.*.registrant_contact.*

Same fields as admin contact, plus:

Field	Type
email.*.count / email.*.value	numeric / string

Technical contact — action_result.data.*.technical_contact.*

Same fields as admin contact: city, country, fax, name, org, phone, postal, state, street (each with .count and .value).

Registrant (top-level) — action_result.data.*

Field	Type
registrant_name.count / registrant_name.value	numeric / string
registrant_org.count / registrant_org.value	numeric / string
registrar.count / registrar.value	numeric / string

DNS and infrastructure fields

IP addresses — action_result.data.*.ip.*

Field	Type
address.count / address.value	numeric / string
asn.*.count / asn.*.value	numeric / string
country_code.count / country_code.value	numeric / string
isp.count / isp.value	numeric / string

Name servers — action_result.data.*.name_server.*

Field	Type
domain.count / domain.value	numeric / string
host.count / host.value	numeric / string
ip.*.count / ip.*.value	numeric / string

Mail servers — action_result.data.*.mx.*

Field	Type
domain.count / domain.value	numeric / string
host.count / host.value	numeric / string
ip.*.count / ip.*.value	numeric / string

SOA email — action_result.data.*.soa_email.*

Field	Type
*.count / *.value	numeric / string

SSL and web fields

SSL info — action_result.data.*.ssl_info.*

Field	Type
alt_names.*.count / alt_names.*.value	numeric / string
common_name.count / common_name.value	numeric / string
duration.count / duration.value	numeric / string
email.*.count / email.*.value	numeric / string
hash.count / hash.value	numeric / string
issuer_common_name.count / issuer_common_name.value	numeric / string
not_after.count / not_after.value	numeric / string
not_before.count / not_before.value	numeric / string
organization.count / organization.value	numeric / string
subject.count / subject.value	numeric / string

Web and redirect — action_result.data.*

Field	Type
redirect.count / redirect.value	numeric / string
redirect_domain.count / redirect_domain.value	numeric / string
server_type.count / server_type.value	numeric / string
website_title.count / website_title.value	numeric / string

Domain metadata fields

Data Path	Type
action_result.data.*.additional_whois_email.*.count	numeric
action_result.data.*.additional_whois_email.*.value	string
action_result.data.*.adsense.count / .value	numeric / string
action_result.data.*.alexa	numeric
action_result.data.*.create_date.count / .value	numeric / string
action_result.data.*.domain_risk.risk_score	numeric
action_result.data.*.email_domain.*.count / .value	numeric / string
action_result.data.*.expiration_date.count / .value	numeric / string
action_result.data.*.first_seen.count / .value	numeric / string
action_result.data.*.google_analytics.count / .value	numeric / string
action_result.data.*.tld	string

Tags

Data Path	Type
action_result.data.*.tags.*.label	string
action_result.data.*.tags.*.scope	string
action_result.data.*.tags.*.tagged_at	string

Configure Scheduled Playbooks

Run on initial setup to configure the optional monitoring playbooks. This action creates a custom list to manage the playbook scheduling and run status.

Type: Investigate Read only: True

Action Parameters

This action requires no parameters.

Action Output

Data Path	Type	Contains	Example Values
action_result.status	string		failed success
action_result.data.*	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

On Poll

Execute scheduled playbooks based on the set interval in domaintools_scheduled_playbooks custom list. Smaller intervals result in more accurate schedules.

Type: ingest Read only: True

Action Parameters

No parameters are required for this action.

Action Output

No Output

Iris Detect Get New Domains

Retrieve newly discovered domains from Iris Detect across all monitors or a specific monitor.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
monitor_id	optional	Monitor ID to filter results to a specific monitor	string
tlds	optional	Comma-separated list of TLDs to filter results (for example, com,net)	string
risk_score_ranges	optional	Comma-separated risk score ranges to filter by (for example, 70-99,100-100)	string
mx_exists	optional	Filter by whether the domain has an MX record	boolean
discovered_since	optional	Filter domains discovered since this datetime (ISO 8601 format)	string
changed_since	optional	Filter domains changed since this datetime (ISO 8601 format)	string
search	optional	Search string to filter domains by name (contains match)	string
sort	optional	Sort field (discovered_date, changed_date, or risk_score)	string
order	optional	Sort order	string
include_domain_data	optional	Include DNS and WHOIS/RDAP details in the response	boolean
limit	optional	Maximum number of results to return (max 100, or 50 if include_domain_data is true)	numeric
offset	optional	Number of results to skip for pagination	numeric
preview	optional	Preview mode for testing — limits results to 10 without hourly rate limit	boolean

Action Output

Data Path	Type	Contains	Example Values
action_result.data.*.domain	string	domain
action_result.data.*.state	string
action_result.data.*.risk_score	numeric
action_result.data.*.risk_score_status	string
action_result.data.*.discovered_date	string
action_result.data.*.changed_date	string
action_result.data.*.status	string
action_result.data.*.tld	string
action_result.data.*.id	string
action_result.data.*.mx_exists	boolean
action_result.data.*.monitor_ids	string
action_result.status	string		success failed
action_result.message	string
action_result.summary.domain_count	numeric
action_result.summary.total_count	numeric
action_result.parameter.monitor_id	string
action_result.parameter.tlds	string
action_result.parameter.risk_score_ranges	string
action_result.parameter.mx_exists	boolean
action_result.parameter.discovered_since	string
action_result.parameter.changed_since	string
action_result.parameter.search	string
action_result.parameter.sort	string
action_result.parameter.order	string
action_result.parameter.include_domain_data	boolean
action_result.parameter.limit	numeric
action_result.parameter.offset	numeric
action_result.parameter.preview	boolean
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Iris Detect Get Watched Domains

Retrieve watched domains from Iris Detect across all monitors or a specific monitor.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
monitor_id	optional	Monitor ID to filter results to a specific monitor	string
tlds	optional	Comma-separated list of TLDs to filter results (for example, com,net)	string
risk_score_ranges	optional	Comma-separated risk score ranges to filter by (for example, 70-99,100-100)	string
mx_exists	optional	Filter by whether the domain has an MX record	boolean
discovered_since	optional	Filter domains discovered since this datetime (ISO 8601 format)	string
changed_since	optional	Filter domains changed since this datetime (ISO 8601 format)	string
escalated_since	optional	Filter domains escalated since this datetime (ISO 8601 format)	string
search	optional	Search string to filter domains by name (contains match)	string
sort	optional	Sort field	string
order	optional	Sort order	string
include_domain_data	optional	Include DNS and WHOIS/RDAP details in the response	boolean
limit	optional	Maximum number of results to return (max 100, or 50 if include_domain_data is true)	numeric
offset	optional	Number of results to skip for pagination	numeric
preview	optional	Preview mode for testing — limits results to 10 without hourly rate limit	boolean

Action Output

Data Path	Type	Contains	Example Values
action_result.data.*.domain	string	domain
action_result.data.*.state	string
action_result.data.*.risk_score	numeric
action_result.data.*.risk_score_status	string
action_result.data.*.discovered_date	string
action_result.data.*.changed_date	string
action_result.data.*.status	string
action_result.data.*.escalations	string
action_result.data.*.tld	string
action_result.data.*.id	string
action_result.data.*.mx_exists	boolean
action_result.data.*.monitor_ids	string
action_result.status	string		success failed
action_result.message	string
action_result.summary.domain_count	numeric
action_result.summary.total_count	numeric
action_result.parameter.monitor_id	string
action_result.parameter.tlds	string
action_result.parameter.risk_score_ranges	string
action_result.parameter.mx_exists	boolean
action_result.parameter.discovered_since	string
action_result.parameter.changed_since	string
action_result.parameter.escalated_since	string
action_result.parameter.search	string
action_result.parameter.sort	string
action_result.parameter.order	string
action_result.parameter.include_domain_data	boolean
action_result.parameter.limit	numeric
action_result.parameter.offset	numeric
action_result.parameter.preview	boolean
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Iris Detect Get Ignored Domains

Retrieve ignored (false positive) domains from Iris Detect across all monitors or a specific monitor.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
monitor_id	optional	Monitor ID to filter results to a specific monitor	string
tlds	optional	Comma-separated list of TLDs to filter results (for example, com,net)	string
risk_score_ranges	optional	Comma-separated risk score ranges to filter by (for example, 70-99,100-100)	string
mx_exists	optional	Filter by whether the domain has an MX record	boolean
discovered_since	optional	Filter domains discovered since this datetime (ISO 8601 format)	string
changed_since	optional	Filter domains changed since this datetime (ISO 8601 format)	string
escalated_since	optional	Filter domains escalated since this datetime (ISO 8601 format)	string
search	optional	Search string to filter domains by name (contains match)	string
sort	optional	Sort field	string
order	optional	Sort order	string
include_domain_data	optional	Include DNS and WHOIS/RDAP details in the response	boolean
limit	optional	Maximum number of results to return (max 100, or 50 if include_domain_data is true)	numeric
offset	optional	Number of results to skip for pagination	numeric
preview	optional	Preview mode for testing — limits results to 10 without hourly rate limit	boolean

Action Output

Data Path	Type	Contains	Example Values
action_result.data.*.domain	string	domain
action_result.data.*.state	string
action_result.data.*.risk_score	numeric
action_result.data.*.risk_score_status	string
action_result.data.*.discovered_date	string
action_result.data.*.changed_date	string
action_result.data.*.status	string
action_result.data.*.tld	string
action_result.data.*.id	string
action_result.data.*.mx_exists	boolean
action_result.data.*.monitor_ids	string
action_result.status	string		success failed
action_result.message	string
action_result.summary.domain_count	numeric
action_result.summary.total_count	numeric
action_result.parameter.monitor_id	string
action_result.parameter.tlds	string
action_result.parameter.risk_score_ranges	string
action_result.parameter.mx_exists	boolean
action_result.parameter.discovered_since	string
action_result.parameter.changed_since	string
action_result.parameter.escalated_since	string
action_result.parameter.search	string
action_result.parameter.sort	string
action_result.parameter.order	string
action_result.parameter.include_domain_data	boolean
action_result.parameter.limit	numeric
action_result.parameter.offset	numeric
action_result.parameter.preview	boolean
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Iris Detect Get Escalated Domains

Retrieve domains escalated to Google Safe Browsing from Iris Detect.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
monitor_id	optional	Monitor ID to filter results to a specific monitor	string
tlds	optional	Comma-separated list of TLDs to filter results (for example, com,net)	string
risk_score_ranges	optional	Comma-separated risk score ranges to filter by (for example, 70-99,100-100)	string
mx_exists	optional	Filter by whether the domain has an MX record	boolean
discovered_since	optional	Filter domains discovered since this datetime (ISO 8601 format)	string
changed_since	optional	Filter domains changed since this datetime (ISO 8601 format)	string
escalated_since	optional	Filter domains escalated since this datetime (ISO 8601 format)	string
search	optional	Search string to filter domains by name (contains match)	string
sort	optional	Sort field	string
order	optional	Sort order	string
include_domain_data	optional	Include DNS and WHOIS/RDAP details in the response	boolean
limit	optional	Maximum number of results to return (max 100, or 50 if include_domain_data is true)	numeric
offset	optional	Number of results to skip for pagination	numeric
preview	optional	Preview mode for testing — limits results to 10 without hourly rate limit	boolean

Action Output

Data Path	Type	Contains	Example Values
action_result.data.*.domain	string	domain
action_result.data.*.state	string
action_result.data.*.risk_score	numeric
action_result.data.*.risk_score_status	string
action_result.data.*.discovered_date	string
action_result.data.*.changed_date	string
action_result.data.*.status	string
action_result.data.*.escalations	string
action_result.data.*.tld	string
action_result.data.*.id	string
action_result.data.*.mx_exists	boolean
action_result.data.*.monitor_ids	string
action_result.status	string		success failed
action_result.message	string
action_result.summary.domain_count	numeric
action_result.summary.total_count	numeric
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Iris Detect Get Blocklist Domains

Retrieve domains escalated for internal blocking from Iris Detect.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
monitor_id	optional	Monitor ID to filter results to a specific monitor	string
tlds	optional	Comma-separated list of TLDs to filter results (for example, com,net)	string
risk_score_ranges	optional	Comma-separated risk score ranges to filter by (for example, 70-99,100-100)	string
mx_exists	optional	Filter by whether the domain has an MX record	boolean
discovered_since	optional	Filter domains discovered since this datetime (ISO 8601 format)	string
changed_since	optional	Filter domains changed since this datetime (ISO 8601 format)	string
escalated_since	optional	Filter domains escalated since this datetime (ISO 8601 format)	string
search	optional	Search string to filter domains by name (contains match)	string
sort	optional	Sort field	string
order	optional	Sort order	string
include_domain_data	optional	Include DNS and WHOIS/RDAP details in the response	boolean
limit	optional	Maximum number of results to return (max 100, or 50 if include_domain_data is true)	numeric
offset	optional	Number of results to skip for pagination	numeric
preview	optional	Preview mode for testing — limits results to 10 without hourly rate limit	boolean

Action Output

Data Path	Type	Contains	Example Values
action_result.data.*.domain	string	domain
action_result.data.*.state	string
action_result.data.*.risk_score	numeric
action_result.data.*.risk_score_status	string
action_result.data.*.discovered_date	string
action_result.data.*.changed_date	string
action_result.data.*.status	string
action_result.data.*.escalations	string
action_result.data.*.tld	string
action_result.data.*.id	string
action_result.data.*.mx_exists	boolean
action_result.data.*.monitor_ids	string
action_result.status	string		success failed
action_result.message	string
action_result.summary.domain_count	numeric
action_result.summary.total_count	numeric
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Iris Detect Get Monitors List

Retrieve the list of monitors configured in Iris Detect for your account.

Type: Investigate Read only: True

Action Parameters

Parameter	Required	Description	Type	Contains
include_counts	optional	Include counts of new, watched, changed, and escalated domains per monitor	boolean
datetime_counts_since	optional	Required if include_counts is true. Datetime to count domains from (ISO 8601 format)	string
sort	optional	Sort field	string
order	optional	Sort order	string
limit	optional	Maximum number of monitors to return (max 100)	numeric
offset	optional	Number of results to skip for pagination	numeric

Action Output

Data Path	Type	Contains	Example Values
action_result.data.*.term	string
action_result.data.*.id	string
action_result.data.*.state	string
action_result.data.*.status	string
action_result.data.*.created_date	string
action_result.data.*.updated_date	string
action_result.data.*.created_by	string
action_result.data.*.match_substring_variations	boolean
action_result.data.*.nameserver_exclusions	string
action_result.data.*.text_exclusions	string
action_result.data.*.domain_counts.new	numeric
action_result.data.*.domain_counts.watched	numeric
action_result.data.*.domain_counts.changed	numeric
action_result.data.*.domain_counts.escalated	numeric
action_result.status	string		success failed
action_result.message	string
action_result.summary.monitor_count	numeric
action_result.summary.total_count	numeric
action_result.parameter.include_counts	boolean
action_result.parameter.datetime_counts_since	string
action_result.parameter.sort	string
action_result.parameter.order	string
action_result.parameter.limit	numeric
action_result.parameter.offset	numeric
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Iris Detect Escalate Domains

Escalate one or more watched domains to Google Safe Browsing via Iris Detect.

Type: correct Read only: False

Action Parameters

Parameter	Required	Description	Type	Contains
watchlist_domain_ids	required	Comma-separated list of Iris Detect domain IDs to escalate to Google Safe Browsing	string

Action Output

Data Path	Type	Contains	Example Values
action_result.data.*.watchlist_domain_id	string
action_result.data.*.escalation_type	string
action_result.data.*.id	string
action_result.data.*.created_date	string
action_result.data.*.created_by	string
action_result.data.*.updated_date	string
action_result.parameter.watchlist_domain_ids	string
action_result.status	string		success failed
action_result.message	string
action_result.summary.escalated_count	numeric
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Iris Detect Blocklist Domains

Escalate one or more watched domains for internal blocking via Iris Detect.

Type: correct Read only: False

Action Parameters

Parameter	Required	Description	Type	Contains
watchlist_domain_ids	required	Comma-separated list of Iris Detect domain IDs to escalate for internal blocking	string

Action Output

Data Path	Type	Contains	Example Values
action_result.data.*.watchlist_domain_id	string
action_result.data.*.escalation_type	string
action_result.data.*.id	string
action_result.data.*.created_date	string
action_result.data.*.created_by	string
action_result.data.*.updated_date	string
action_result.parameter.watchlist_domain_ids	string
action_result.status	string		success failed
action_result.message	string
action_result.summary.blocklisted_count	numeric
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Iris Detect Watch Domains

Add one or more domains to the Iris Detect watchlist for ongoing monitoring.

Type: correct Read only: False

Action Parameters

Parameter	Required	Description	Type	Contains
watchlist_domain_ids	required	Comma-separated list of Iris Detect domain IDs to add to the watchlist	string

Action Output

Data Path	Type	Contains	Example Values
action_result.data.*.domain	string	domain
action_result.data.*.state	string
action_result.data.*.id	string
action_result.data.*.discovered_date	string
action_result.data.*.changed_date	string
action_result.parameter.watchlist_domain_ids	string
action_result.status	string		success failed
action_result.message	string
action_result.summary.watched_count	numeric
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1

Iris Detect Ignore Domains

Mark one or more domains as ignored (false positives) in Iris Detect.

Type: correct Read only: False

Action Parameters

Parameter	Required	Description	Type	Contains
watchlist_domain_ids	required	Comma-separated list of Iris Detect domain IDs to mark as ignored	string

Action Output

Data Path	Type	Contains	Example Values
action_result.data.*.domain	string	domain
action_result.data.*.state	string
action_result.data.*.id	string
action_result.data.*.discovered_date	string
action_result.data.*.changed_date	string
action_result.parameter.watchlist_domain_ids	string
action_result.status	string		success failed
action_result.message	string
action_result.summary.ignored_count	numeric
summary.total_objects	numeric		1
summary.total_objects_successful	numeric		1