How many filters (“Text Exclusions” or “Name Server Exclusions”) can be set for a monitor term in Iris Detect?

Iris Detect allows for a substantial number of exclusions, and is currently limited to 95 filters.

How fast is Iris Detect?

The answer is “it depends,” but let’s put it this way: for a term with many hits, you are likely to see new domains appear in the dashboard within a few minutes as you navigate around the UI. But there are many variables at play, including TLD, data source availability, system load, and others. Here are some details on the data update frequency:
– The underlying system is being updated continuously. These changes are made available into the UI as soon as the updated data has been processed
– The API query limit is 1x/hour
– Email updates can be configured for daily or 4x/day delivery options

What makes the subdomain information in Iris Detect valuable?

Subdomains can often tell an important story about how the domain is intended to be used. They can signal things such as:
– TTPs. A subdomain such as “login.” or “secure.” suggests that a credential harvesting campaign may be in the works.
– Stage of development. The presence of non-default subdomains suggests that the controlling entity is staging the domain. Some common defaults you will see are “www.”, “webdisk.”, and “cpanel.”
– Connection patterns. A unique pattern of subdomains can be used as a search query in the pDNS panel of Iris Investigate to find other domains that may be under the same entity’s control.
Good to know: subdomains are populated on-demand when you click the Subdomains panel. They are not pre-loaded.

Can my Iris Detect monitor be set up with multiple terms, like PhishEye?

No. However, filters can be applied, such as Text or Name Server exclusions, that help improve results of monitored terms.

Is there a limit to the number of escalations (Google Phishing Protection and Block) a client can perform based on the price model for Iris Detect?

For blocking, there is no limit. The Block action simply flags the domain as Blocked so it shows up as such in API calls . For Google Phishing Protection, the UI limits you to 10 domains at a time, but you can repeat this process as many times as you wish from the UI’s perspective.

As a Group Administrator, can I control which team members have the ability to add or edit monitors in Iris Detect?

Yes. While all Group members will have access to the UI itself, the Group Admin can control which members can edit monitors. Be aware that all users within a group will see all monitors, even those who don’t have privileges to add new ones.

Can I add alerting email recipients that are not members of my group like I can in PhishEye?

Yes. Iris Detect does not limit what email addresses can be added.

Can I export my current table view from Iris Detect to an Iris Investigate investigation?

Yes! This is done via a multi-select of all desired domains, and you can capture multiple pages of domains by selecting all, clicking to the next page, selecting all, etc.

Am I alerted when any new data point is updated on a watched term in Iris Detect?

Not exactly. There are subtleties to this, as it depends on how you interpret “term.”
– When the term itself (not a domain) is one of your monitors, you will receive alerts on new matching domains, but not on individual data points within those domains unless they are on the Watchlist
– If a domain is Watched, then updates on any of the following data points will trigger alerts: IP address, NS hostname, MX hostname, Whois Registrar, Registrant email, and Create Date
– As a reminder, the alert emails can be configured to be sent 1x or 4x/day for new domains and for the changes in watched domains. Note that receiving alerts on changes in watched domains is an optional checkbox in the alert configuration
– The API query frequency is limited to 1x/hour

What are my options to be notified of a new domain matching my search as quickly as possible via Iris Detect?

The fastest way is by querying the API for updates (using the domains endpoint), which can be queried up to once per hour. For folks who prefer email notifications, the options are once per day or 4x per day.
Also, while it’s not a notification per se, if you’re in the UI when a new domain comes in, you’ll see it at the top of the New domains list. You also might notice a brief animation of the stats box at the top of the dashboard for New or Watched. You can also see the same animation if you take an action such as moving domains from New to Watched or Ignored.