Enrich on-network
indicators at-scale
The DomainTools Iris data set helps analysts, detection engineering teams, threat hunters, and other practitioners obtain critical situational awareness on domains or IP addresses observed in the protected environment. Whois, DNS, SSL certificate, and risk scoring elements help build out the needed context for the appropriate disposition of indicators. Iris Enrich APIs are REST-based and OpenAPI compatible, making it easy to incorporate into your own internal tools.
Key Benefits
- Comprehensive Data Sources
- Insights into Emerging Threats
- Infrastructure Risk Assessment
Enhance SIEM, SOAR and Security Controls
Iris Enrich API Offerings
Automate Enrichment of Domain and IP Indicators
- Supports high query volumes of domain name attributes.
- Provides actionable insights at scale with enterprise-class ingestion of DomainTools data to support 3rd party or purpose-built platforms.
- Creates a seamless view of data to provide an easy transition from SIEM alert to human analysis.
Confidence in the Data
The most trusted online infrastructure data. Anywhere.
Timely
Near real-time risk scoring on all newly registered and discovered domains
Comprehensive
>97% of currently registered domains
Connected
Sophisticated associations across datasets to accelerate action.
