What is the main difference between the Iris Investigate API and the Iris Enrich API?

The Iris Enrich API was developed to take advantage of the vast amount of data available in the Iris dataset and is typically implemented in a SIEM solution, such as Splunk , or a custom-built data analytics platform using open-source solutions like the ELK stack. As the primary use case is bulk data enrichment, it is therefore optimized for fast response and high volume lookups, therefore it does not offer most of the search parameters available in the Iris Investigate API. Instead it accepts a list of up to 100 comma separated domains in the domain parameter.

Can the rate limit be adjusted for the Iris Enrich API?

Iris Enrich is sold according to organizational size and use case. Please contact sales for additional details.

Can the domain in the Iris Enrich API parameter accept more than 100 domains?

No, the maximum number of domains which the domain parameter will accept is 100, and these must be comma separated.

Can the Iris Enrich API return the data in other formats such as XML?

Yes, the Iris Enrich API returns results in JSON format by default, however the format parameter can be used to select HTML or XML either.

Does the Iris Enrich API support subdomains?

No, the Iris Enrich API does not support subdomains. Any subdomains entered in the domain parameter will be returned under the missing_domains parameter.

Does the Iris Enrich API clean the input domain (remove the subdomain) and get the apex only?

No, any input other than a domain name in the format of “domain.tld” (e.g. domaintools.com) will not return any results, and will be returned under the missing_domains parameter which lists any entries submitted via the ​domains parameter that were not found in the Iris data set. This makes it easier to know if no data was available for one or more of the domains you requested in a batch query.

Does Iris Enrich allow any other inputs than domain names?

No. The Iris Enrich API only accepts domain names as valid query terms. All other inputs, such as IP addresses, emails or FQDNs will fail.