Iris platform
Iris is a comprehensive threat intelligence platform that streamlines the entire security workflow, from proactive discovery to deep investigation and automated enrichment. Iris Investigate enables deep analysis and mapping of adversary infrastructure, Iris Enrich automatically adds context to indicators at scale for SIEM and SOAR platforms, and Iris Detect proactively discovers malicious and lookalike domains.
Iris Investigate
Section titled “Iris Investigate”Purpose
Section titled “Purpose”Iris Investigate helps security professionals conduct deep analysis and map adversary infrastructure using enterprise-grade domain intelligence and risk scoring.
Capabilities
Section titled “Capabilities”- Threat intelligence: Access DNS and passive DNS data, screenshots, web content, WHOIS and Registration Data Access Protocol (RDAP) records, TLS certificate data, and risk scores.
- Infrastructure mapping: Visualize and pivot between connected data points to map attacker infrastructure
- Domain risk scoring: Assess the risk of a domain to quickly identify threats
- Web interface: Use the web interface for in-depth investigation and domain infrastructure analysis.
- API integration: If your account includes API access, integrate Iris Investigate data into your security tools and workflows.
Use cases
Section titled “Use cases”- Threat hunting: Proactively search for threats by pivoting between data points
- Incident response: Quickly understand the scope of an attack by mapping out related infrastructure
- Adversarial campaign investigation: Identify and investigate connected domains used in targeted and opportunistic cyber operations.
Learn more about Iris Investigate | Iris Investigate API documentation
Iris Enrich
Section titled “Iris Enrich”Purpose
Section titled “Purpose”Iris Enrich is an API designed for programmatic integration into high-volume security workflows like SIEM and SOAR platforms. Its core function is to take a domain name, e.g. from a security alert, and automatically add crucial context. This includes data like the domain’s risk score and registrant details, enabling automated triage and faster incident response.
Capabilities
Section titled “Capabilities”- API-first design: Built for programmatic integration into high-volume security workflows.
- Contextual enrichment: Adds crucial context to indicators of compromise, including domain risk score, DNS hosting infrastructure, and registration details.
- SIEM/SOAR integration: Integrate Iris Enrich with SIEM and SOAR platforms. See Integrations for product-specific support.
- High-volume lookups: Designed to handle a large number of requests for automated workflows.
Use cases
Section titled “Use cases”- Automated triage: Automatically enrich alerts in your SIEM or SOAR to prioritize the most critical threats.
- Faster incident response: Provide your security team with the context they need to respond to incidents more quickly and effectively.
- Improved alert fidelity: Reduce false positives by enriching alerts with additional data.
Iris Detect
Section titled “Iris Detect”Purpose
Section titled “Purpose”Iris Detect is a lookalike domain name discovery, alerting, and triaging tool. It rapidly discovers new domain names containing typo-squatting variations of your monitored keyword, enabling keyword monitoring, network defense, and threat actor tracking by alerting for specific domain patterns.
Capabilities
Section titled “Capabilities”- Rapid discovery and risk scoring: Quickly identify and assess the risk of potentially malicious domain names within minutes.
- Customizable monitors: Create and edit monitors via the web interface, with near real-time updates based on search terms and fuzzy matching.
- Automation capabilities: Automate detection and escalation actions, including submission to Google Web Risk and tracking submission statuses.
- API access: Utilize the Iris Detect API for programmatic searching, filtering, watchlisting, and escalating domain names.
- Flexible matching: Use matching options for exact domain names and lookalikes, including full-domain, fuzzy, internationalized domain name, and variation matching.
- Filtering and sorting: Highlight latest changes in domain name infrastructure and filter/sort domain names by various criteria like risk score and TLDs.
Use cases
Section titled “Use cases”- Keyword monitoring: Identify and receive alerts for newly registered or observed domains related to brands, public figures, geopolitical events, or other monitored terms.
- Network defense: Identify domain names spoofing internal enterprise tech stack assets (e.g. SSO providers) or key partners, and track domains impersonating supply chain infrastructure regularly used by your employees.
- Automated security workflows: Integrate Iris Detect into existing security operations for automated detection and escalation.
Learn more about Iris Detect | Iris Detect API documentation