Every second, a massive influx of events hits SIEM tools, and these numbers continue to rise. With this in mind, organizations need the ability to execute high-volume queries with low latency. The DomainTools® App for Splunk allows customers to rapidly enrich domains with tagging, Domain Risk Score, domain age, Whois, IPs, active and passive DNS provided by Farsight’s DNSDB, and other connected infrastructure to surface evidence of malicious activity. Moreover, newly-appearing domains identified by Iris Detect can be triaged and alerted on directly within the App.

Precisely Target Alerts and Hunt Threats Across Your Enterprise

Support and Learning

About Splunk

Splunk turns machine data into answers. Regardless of your organization’s size and industry, Splunk can give you the answers you need to solve your toughest IT, security and business challenges—with the option to deploy on-premises, in the cloud or a hybrid approach.

The post Splunk appeared first on DomainTools | Start Here. Know Now..

The DomainTools® Iris™ App for Anomali delivers a subset of DomainTools Iris data, together with pivot capability and domain risk score, directly to the analyst inside the Anomali Security Operations Platform. This integration enables rapid in-context assessments of domain name observables and discovery of connected domains that share the same IP, hostname, or SSL certificate hash.

Enrichment Powered by the DomainTools Iris Investigate API

Support and Learning

Anomali Threatstream

Anomali helps organizations find and respond to cyber threats. That’s our mission. We bring to your security team the one thing that’s been missing – external context. With Anomali you can now identify suspicious or malicious traffic before it even reaches your network. We turn threat intelligence into your cyber no-fly list, and seamlessly integrate this with your internal security and IT systems.

The post Anomali appeared first on DomainTools | Start Here. Know Now..

The DomainTools® App for Elastic provides maximum value for our customers who are utilizing Elastic within their SecOps. Elastic customers utilizing the ELK stack can readily leverage all functionalities out of the box.

The DomainTools app focuses on enabling core enrichment functionality along with a purpose-built user interface that will help analyze our diverse dataset—giving you deep visibility of your network events. Gain all this while creating a stable and scalable app architecture that can grow with your adoption.

Gain Visibility of Network Events

Support and Learning

About Elastic

Elastic builds enterprise search, observability, and security solutions to make data usable in real time and at scale. From finding documents to monitoring infrastructure to hunting for threats, Elastic solutions are built on one, free and open technology stack that can be deployed anywhere to instantly find actionable insights from any type of data. 

The Elastic (ELK) Stack has long been used by security teams and organizations to extract valuable security insights from all their data, enabling them to evolve quickly and solve complex security problems. Elastic Security builds on the power of the Elastic Stack to deliver pre-built capabilities that help security teams evolve even faster. The solution enables a unified, out of the box approach to security — with the inherent benefits of speed, scale, and relevance that Elasticsearch is known for.

The post Elastic (ELK) Stack appeared first on DomainTools | Start Here. Know Now..

The DomainTools® App for IBM QRadar gives analysts fast, in-context access to key information about domains, IP addresses, and SSL hashes that appear in events within Offenses. 

Triage events and gain situational awareness around adversary infrastructure, and launch DomainTools Iris Invesstigate™ for deeper investigations. Pinpoint high-risk or recently-registered domains that may represent threats.

Infrastructure Intelligence Within QRadar

Support and Learning

About IBM QRadar

IBM QRadar® is a Security Information and Event Management (SIEM) that helps security teams accurately detect and prioritize threats across the enterprise, and provides intelligent insights that enable teams to respond quickly to reduce the impact of incidents.

The post IBM QRadar appeared first on DomainTools | Start Here. Know Now..

When you add world-class passive DNS and domain registration data to one of the leading SIEM platforms, a lot of powerful incident response (IR) and hunting use cases are unlocked. The DomainTools® App for Microsoft Sentinel allows customers to rapidly enrich domains with Domain Risk Score, domain age, Whois, IPs, active and passive DNS provided by Farsight’s DNSDB, and other connected infrastructure data to surface evidence of malicious activity. 

Precisely Target Alerts and Hunt Threats Across Your Enterprise

Support and Learning

About Microsoft Sentinel

Microsoft Sentinel is a scalable, cloud-native solution that provides:

• Security information and event management (SIEM)
• Security orchestration, automation, and response (SOAR)

Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise. With Microsoft Sentinel, you get a single solution for attack detection, threat visibility, proactive hunting, and threat response.

The post Microsoft Sentinel appeared first on DomainTools | Start Here. Know Now..