URL linking
Create URLs that link directly to specific searches or data panels in Iris Investigate. Use these URLs to share searches, bookmark investigations, or integrate with external tools.
Link to a search
Section titled “Link to a search”Basic format
Section titled “Basic format”https://iris.domaintools.com/investigate/search/?q={SEARCH_VALUE}Simple domain or IP searches
Section titled “Simple domain or IP searches”Append the domain name or IP address directly:
https://iris.domaintools.com/investigate/search/?q=domaintools.comField-specific searches
Section titled “Field-specific searches”Use shortcodes for precise searches:
https://iris.domaintools.com/investigate/search/?q=ip.asn:"209242"Format: shortcode:"value"
Common examples
Section titled “Common examples”| Search Type | URL |
|---|---|
| Domain | https://iris.domaintools.com/investigate/search/?q=example.com |
| IP Address | https://iris.domaintools.com/investigate/search/?q=4.2.2.2 |
| ASN | https://iris.domaintools.com/investigate/search/?q=ip.asn:"209242" |
https://iris.domaintools.com/investigate/search/?q=em:"admin@example.com" | |
| Registrar | https://iris.domaintools.com/investigate/search/?q=reg:"GoDaddy" |
For a complete list of shortcodes, see Search Reference.
Link to a data panel
Section titled “Link to a data panel”Basic format
Section titled “Basic format”https://iris.domaintools.com/investigate/search/?q={DOMAIN or IP}&tab=panel-{IDENTIFIER}Panel identifiers
Section titled “Panel identifiers”For domain names:
| Panel | Identifier |
|---|---|
| Domain Profile | domain-profile |
| Domain History | domain-history |
| Screenshot History | screenshot-history |
| WHOIS History | whois-history |
| SSL Profile | ssl-profile |
For IP addresses:
| Panel | Identifier |
|---|---|
| IP Profile | ip-profile |
| IP Tools | ip-tools |
Examples
Section titled “Examples”Link to domaintools.com Screenshot History:
https://iris.domaintools.com/investigate/search/?q=domaintools.com&tab=panel-screenshot-historyLink to 141.193.213.20 IP Profile:
https://iris.domaintools.com/investigate/search/?q=141.193.213.20&tab=panel-ip-profileLink to example.com WHOIS History:
https://iris.domaintools.com/investigate/search/?q=example.com&tab=panel-whois-historyUse cases
Section titled “Use cases”Bookmarking
Section titled “Bookmarking”Save frequently used searches:
- Monitoring specific domains.
- Tracking infrastructure.
- Regular threat hunting queries.
Sharing
Section titled “Sharing”Share searches with team members:
- Investigation starting points.
- Interesting findings.
- Reproducible queries.
Integration
Section titled “Integration”Integrate with external tools:
- SIEM platforms.
- Ticketing systems.
- Threat intelligence platforms.
- Custom dashboards.
Documentation
Section titled “Documentation”Include in documentation:
- Investigation procedures.
- Threat reports.
- Training materials.
- Runbooks.
Best practices
Section titled “Best practices”URL encoding
Section titled “URL encoding”When constructing URLs programmatically, ensure proper URL encoding:
- Spaces →
%20. - Special characters → URL-encoded equivalents.
- Quotes →
%22.
Shortcode usage
Section titled “Shortcode usage”Always use shortcodes for field-specific searches to avoid ambiguity:
- ✅
?q=ip.asn:"209242": Searches ASN field. - ❌
?q=209242: May match multiple field types.
Testing
Section titled “Testing”Test URLs before sharing:
- Verify the search returns expected results.
- Confirm the correct panel opens.
- Check for proper encoding.
Limitations
Section titled “Limitations”- URLs reflect search parameters, not investigation state.
- Tags and notes aren’t included in URLs.
- Historical search settings use global defaults.
- Advanced search filters may require complex URL construction.
See also
Section titled “See also”- Basic Search: Search techniques.
- Search Reference: Complete shortcode list.
- Search Hashes: Alternative sharing method.