IBM QRadar

Boost Situational Awareness Around Key Events

The DomainTools® App for IBM QRadar gives analysts fast, in-context access to key information about domains, IP addresses, and SSL hashes that appear in events within Offenses.

Triage events and gain situational awareness around adversary infrastructure, and launch DomainTools Iris Invesstigate™ for deeper investigations. Pinpoint high-risk or recently-registered domains that may represent threats.

Infrastructure Intelligence Within QRadar

Domain Details at a Glance
When domains appear within an Offense in QRadar, the DomainTools app provides information that analysts rely on, including:
- Predictive Domain Risk Scores
- Registration details from Whois and DNS SOA records
- IP address, name server, and MX records
- SSL/TLS certificate hashes
Need to go deeper? Launch an investigation in DomainTools Iris.

Download From IBM APP Exchange

If you are a current DomainTools customer, please contact your Account Manager before downloading the DomainTools QRadar App. We want to ensure that you have the proper inputs to make the application work to your advantage.
Details on Potentially Risky Infrastructure
IP addresses within Offenses have on-demand enrichment available, including:
- Ability to pivot on the IP, seeing what domains are associated with it
- Ability to launch an investigation of the IP in DomainTools Iris
Pivot Investigations on SSL/TLS Hashes
Increasingly, analysts and threat hunters are relying on SSL/TLS hashes to uncover insights on adversary assets. SSL/TLS hashes within Offenses have on-demand enrichment available, including the ability to:
- Pivot on the hash, seeing what domains are associated with it
- Launch an investigation of domains connected to the certificate in DomainTools Iris

Support and Learning

Webinar

Applying DomainTools Intelligence Inside of IBM QRadar

Learn More
User Guides

DomainTools App for IBM QRadar

Learn More
Blog

Optimizing Incident Response With the DomainTools App for IBM QRadar

Learn More

About IBM QRadar

IBM QRadar® is a Security Information and Event Management (SIEM) that helps security teams accurately detect and prioritize threats across the enterprise, and provides intelligent insights that enable teams to respond quickly to reduce the impact of incidents.