---
title: "Automated Data Services Overview | ThreatConnect"
slug: "automated-data-services-overview"
description: "This article provides an overview of automated data services in ThreatConnect and the corresponding minimum roles and prerequisites for this feature."
tags: ["Analytical Tools"]
updated: 2024-02-08T16:24:17Z
published: 2024-02-08T16:24:17Z
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Automated Data Services Overview

ThreatConnect® leverages several automated data services to enable automated correlation and discovery of threat intelligence. These services allow analysts to efficiently investigate and analyze Domain Name System (DNS) relationships, registrants for Internet resources (using the WHOIS protocol), IP address geographic information, and location and count information for computers that attempted to access suspicious domains captured by Quad9® infrastructure within the last 90 days.

The following data services are currently available from the relevant Indicators’ [**Details** screen](/docs/the-details-screen):

- [DNS resolutions for Host Indicators](/docs/dns-resolutions#host-indicators) (current and historical, as well as subdomains)
- [DNS resolutions for Address Indicators](/docs/dns-resolutions#address-indicators) (current and historical)
- [IP geolocation data](/docs/ip-geolocation-data) for Address and Host Indicators
- [WHOIS information](/docs/whois-registration-information) for Host Indicators

## Before You Start

| Minimum Role(s) | - Organization role of Read Only User (for viewing information provided by automated data services) - Organization role of Standard User (for activating and deactivating automated data services) |
| --- | --- |
| Prerequisites | - An Address [Indicator](/docs/the-threatconnect-data-model) created in one of your ThreatConnect owners (to view IP geolocation data and Address DNS resolutions) - A Host Indicator created in one of your ThreatConnect owners (to view Host DNS resolutions, IP geolocation data for Addresses that have resolved to the Host, and WHOIS information) |

---

*ThreatConnect® is a registered trademark of ThreatConnect, Inc.* *Quad9® is a registered trademark of Quad9 Foundation.*

20030-01 v.12.A

## Related

- [Associations](/associations.md)
- [Pivoting on Data](/pivoting-on-data.md)
- [The Details Screen](/the-details-screen.md)