Skip to main content
DomainTools Iris app icon

DomainTools Iris

This app supports investigative actions to profile domain names, get risk scores, and find connected domains that share the same Whois details, web hosting profiles, SSL certificates, and more on DomainTools Iris. For the playbooks on the domain tool data visit https://github.com/DomainTools/playbooks/tree/master/Splunk%20PhantomBuilt by srv-stage-community
soar product badge
Default Version 1.1.0

September 17, 2021

Compatibility

SOAR On-Prem

Platform Version: 5.5, 5.4, 5.3, 5.2, 5.1, 5.0, 4.10, 4.9, 4.8, 4.7, 4.6, 4.5

Rating
0
(0)

Log in to rate this app

Support
Not Supported
Ranking

#11 in Information

This app supports investigative actions to profile domain names, get risk scores, and find connected domains that share the same Whois details, web hosting profiles, SSL certificates, and more on DomainTools Iris. For the playbooks on the domain tool data visit https://github.com/DomainTools/playbooks/tree/master/Splunk%20Phantom

Supported actions

  • test connectivity: Validate the asset configuration for connectivity
  • domain reputation: Evaluates the risk of a given domain
  • pivot action: Find domains connected by any supported Iris search parameter
  • reverse domain: Extract IPs from a single domain response for further pivoting
  • reverse ip: Find domains with web hosting IP, NS IP or MX IP
  • load hash: Load or monitor Iris search results by Iris export hash
  • reverse email: Find domains with email in Whois, DNS SOA or SSL certificate
  • whois domain: Get all Iris data for a domain, including Whois