DomainTools Enrichment

Overview

The DomainTools® built-in enrichment in ThreatConnect® lets you access DomainTools’ deep domain insights directly within ThreatConnect, providing you with a more complete perspective on potential security threats and further boosting the depth and efficacy of your threat intelligence investigations.

This article describes how to enable the DomainTools Indicator enrichment service in ThreatConnect, view data retrieved from DomainTools on the Enrichment tab of an Indicator’s Details screen, and import related Indicators from DomainTools into ThreatConnect.

Before You Start

User Roles

To enable and configure the DomainTools enrichment, your user account must have a System role of Administrator.
To view and retrieve DomainTools data on the Enrichment tab of an Indicator’s Details screen for an Indicator in your home Organization, your user account can have any Organization role.
To view and retrieve DomainTools data on the Enrichment tab of an Indicator’s Details screen for an Indicator in any Organization on your ThreatConnect instance, your user account must have a System role of Super User.
To view and retrieve DomainTools data on the Enrichment tab of an Indicator’s Details screen for an Indicator in a Community or Source, your user account can have any Community role except Banned in that Community or Source.
To import related Indicators from the DomainTools Indicator enrichment service into an enriched Indicator’s Organization, your user account must have an Organization role of Standard User, Sharing User, Organization Administrator, or App Developer in that Organization.
To import related Indicators from the DomainTools Indicator enrichment service into any Organization on your ThreatConnect instance, your user account must have a System role of Super User.
To import related Indicators from the DomainTools Indicator enrichment service into a Community or Source, your user account must have a Community role of Contributor, Editor, or Director for that Community or Source.

Prerequisites

To enable the DomainTools Indicator enrichment service on your ThreatConnect instance, you must have valid DomainTools API credentials (API username and API key) that are authorized to access Iris® Investigate.
To be able to view DomainTools enrichment data for Host Indicators, the DomainTools enrichment must be enabled for that Indicator type on your ThreatConnect instance (must be a System Administrator to perform this action).

Enabling the DomainTools Enrichment

Follow these steps to enable and configure the DomainTools enrichment on your ThreatConnect instance:

From the Settingsmenu on the top navigation bar, select System Settings.
Select the Indicators tab.
Select Enrichment Tools from the left sidebar.
Click Editin the Options column for DomainTools and fill out the fields on the Edit Vendor window (Figure 1) as follows:
- Enable Vendor: Select this checkbox to enable DomainTools.
- Enable Automatic Retrieval: Select this checkbox to enable automatic data retrieval for DomainTools. If automatic data retrieval is enabled, DomainTools data automatically populate when a user opens a Host Indicator’s Enrichment tab for the first time.
  Important
  The API credentials entered in the next two fields are used each time data are retrieved from DomainTools for an Indicator. To limit API credential usage to manual retrieval only, select this checkbox.
- DomainTools User Name: Enter the API username to retrieve data from DomainTools.
- API Key: Enter the API key to retrieve data from DomainTools.
- VALIDATE: Click this button to validate the DomainTools API credentials. If the API credentials are accepted, the VALIDATE button’s label will change to VALID.
- Lookup/Retrieve: Select Host to retrieve data from DomainTools for Host Indicators.
Click SAVE.

Important

If you make changes to the Edit Vendor window when the vendor is enabled, you need to revalidate the API credentials to save those changes.

Data Overview

The Overview section of the DomainTools card (Figure 2) on the Enrichment tab of a Host Indicator’s Details screen provides a summary of data retrieved from DomainTools for the Indicator and the date and time the data were last retrieved.

Figure 2_DomainTools Enrichment_7.8.1

Overall Risk Score: The overall score provided in the DomainTools Domain Profile for the Host. This score predicts how likely a domain is to be malicious.
Malware Risk Score: The malware score provided in the DomainTools Domain Profile for the Host. This score is a measure of how closely a domain resembles domains used for malware.
Phishing Risk Score: The phishing score provided in the DomainTools Domain Profile for the Host. This score is a measure of how closely a domain resembles domains used for phishing.
Spam Risk Score: The spam score provided in the DomainTools Domain Profile for the Host. This score is a measure of how closely a domain resembles domains used for spam.
Domain Status: The Host’s domain status (active or inactive).
Registrant Org: The organization that registered the Host.
Registrar: The registrar for the Host’s registration.
IP Addresses: The IP addresses associated with the Host.
IP Addresses’ Countries: The countries in which the IP addresses associated with the Host are registered.
ASNs: The autonomous system numbers (ASNs) associated with the Host.

Hint

When constructing a TQL query, you can use the following parameters to query for Host Indicators based on their scores and status in DomainTools:

dtOverallScore: Query by the Host’s overall score in DomainTools
dtMalwareScore: Query by the Host’s malware score in DomainTools
dtPhishingScore: Query by the Host’s phishing score in DomainTools
dtSpamScore: Query by the Host’s spam score in DomainTools
dtStatus: Query by the Host’s domain status in DomainTools

DomainTools Detailed View

Click Open Detailed View on the DomainTools card to open the DomainTools Detailed View drawer (Figure 3), which displays cards with additional data retrieved from DomainTools.

Figure 3_DomainTools Enrichment_7.8.1

The DomainTools Detailed View drawer displays the following cards:

Email Address Details: The email addresses associated with the Host and the number of domains associated with each email address.
IP Address Details: The IP addresses associated with the Host and the number of domains associated with each IP address.
Name Server Details: The name servers associated with the Host and the number of domains associated with each name server.
SSL Information: The secure sockets layer (SSL) certificates associated with the Host. Details displayed for each SSL certificate include the certificate fingerprint (i.e., the unique identifier for the SSL certificate), the common name (i.e., the primary domain name associated with the certificate), and dates establishing the time window during which the certificate is valid.

Note

The DomainTools Detailed View drawer displays only cards for which data were returned from DomainTools.

Importing Indicators From DomainTools Into ThreatConnect

You may import Indicators displayed on the Email Address Details, IP Address Details and Name Server Details cards into ThreatConnect and associate them to a new or existing Group. You may also import Indicators displayed on the Email Address Details and IP Address Details cards into ThreatConnect and associate them directly to the enriched Indicator (i.e., the Host Indicator whose Details screen you are viewing) via a custom association.

Follow these steps to import Indicators from DomainTools into ThreatConnect:

Expand one of the following cards on the DomainTools Detailed View drawer (Figure 3) to view Indicators retrieved from DomainTools that are related to the enriched Indicator:
- Email Address Details: Indicators on this card will be imported as Email Address Indicators.
- IP Address Details: Indicators on this card will be imported as Address Indicators.
- Name Server Details: Indicators on this card will be imported as Host Indicators.
Select the checkbox for each Indicator to import into ThreatConnect, or select the checkbox in the table’s header to import all Indicators displayed on the current page in the table.
Important
If a selected Indicator already exists in the ThreatConnect owner into which you are importing data, that copy of the Indicator will be updated based on the information entered and options configured during the import.
Expand the Import dropdown at the top left of the card and select one of the following import options:
- To New Group: Select this option to import the selected Indicators and associate them to a new Group created during the import.
- To Existing Group: Select this option to import the selected Indicators and associate them to an existing Group.
- As an Indicator: Select this option to import the selected Indicators and associate them directly to the enriched Indicator via a custom association.

Note

If associating the Indicators selected for import to a new or existing Group, the Group will also be associated to the enriched Indicator, thus creating a second-level (i.e., indirect) association between the Indicators imported from DomainTools and the enriched Indicator.

Importing Indicators Into a New Group

Follow these steps to import Indicators from DomainTools and associate them to a new Group created during the import:

Follow Steps 1–3 in the “Importing Indicators From DomainTools Into ThreatConnect” section and select To New Group from the Import dropdown.
Proceed through the steps on the Create screen to create the Group and configure the Indicators selected for import.
- Follow the instructions in the “Step 1: Enter Details About the Group” section of Creating Groups to fill out the fields on the Details step.
  Important
  - By default, Event is selected for the Type field.
  - By default, the Tags field includes a DomainTools Enrichment Tag. If you select the Apply Tags To Associations checkbox, it is recommended that you remove this Tag. Otherwise, this Tag will be applied to the enriched Indicator (that is, the Indicator whose Enrichment tab you are importing DomainTools data from), as this Indicator will be added as an association to the new Group. Alternatively, if you want to apply the DomainTools Enrichment Tag to all associations except for the enriched Indicator, select Apply Tags to Associations, leave the DomainTools Enrichment Tag in the Tags field, and then, after completing the import, navigate to the enriched Indicator’s Details screen and remove the Tag from the Indicator manually.
- Follow the instructions in the “Step 2: Create Associations for the Group (Optional)” section of Creating Groups to fill out the fields on the Associations step.
  Important
  - The Indicator Type card is not displayed because the Indicators to be associated are already selected from the card on the DomainTools Detailed View drawer.
  - All information added in this section is applied to the enriched Indicator (that is, the Indicator whose Enrichment tab you are importing DomainTools data from), because the enriched Indicator is always added as an association to the new Group, along with the Indicators selected on the card on the DomainTools Detailed View drawer. If the enriched Indicator has a default Description, a Threat Rating, or a Confidence Rating and you enter a value for one of these fields, then that value will replace the existing value for the enriched Indicator. Tags entered in this section will be applied in addition to the enriched Indicator’s existing Tags.
- Follow the instructions in the “Step 3: Upload File Attachments to the Group (Optional)” section of Creating Groups to fill out the fields on the Attachments step.

Importing Indicators Into an Existing Group

Follow these steps to import Indicators from DomainTools and associate them to an existing Group:

Follow Steps 1–3 in the “Importing Indicators From DomainTools Into ThreatConnect” section and select To Existing Group from the Import dropdown.
On the Select Group step of the Import to Existing Group screen, select an existing Group to associate to the imported Indicators.
Follow the instructions in the “Step 2: Create Associations for the Group (Optional)” section of Creating Groups to fill out the fields on the Associations step.
Important
- The Indicator Type card is not displayed because the Indicators to be associated are already selected from the card on the DomainTools Detailed View drawer.
- All information added in this section is applied to the enriched Indicator (that is, the Indicator whose Enrichment tab you are importing DomainTools data from), because the enriched Indicator is always added as an association to the new Group, along with the Indicators selected on the card on the DomainTools Detailed View drawer. If the enriched Indicator has a default Description, a Threat Rating, or a Confidence Rating and you enter a value for one of these fields, then that value will replace the existing value for the enriched Indicator. Tags entered in this section will be applied in addition to the enriched Indicator’s existing Tags.

Importing Indicators as Indicators

Follow these steps to import Indicators from DomainTools and associate them directly to the enriched Indicator via a custom association:

Follow Steps 1–3 in the “Importing Indicators From DomainTools Into ThreatConnect” section and select As an Indicator from the Import dropdown.
Important
The As an Indicator option is not available for Indicators displayed on the Name Server Details card.
On the Import Indicators window, review the list of Indicators and click Import Indicators to import and associate them directly to the enriched Indicator via a custom association.

Retrieving Data Manually

When you open an Indicator’s Enrichment tab for the first time, data are automatically retrieved from DomainTools and displayed on the DomainTools card if your System Administrator enabled automatic data retrieval for DomainTools. If no data are displayed, click Retrieve Data on the card to retrieve data manually. Once data are retrieved, they are cached for a period of time configured by your System Administrator. Each time you revisit that Indicator’s Enrichment tab, the cached DomainTools data are displayed until this period of time has passed. You can click Retrieve Data to update the displayed data at any time.

Enriching Indicators Using the ThreatConnect API

You can use the ThreatConnect v3 API to enrich Host Indicators with data from DomainTools. For instructions on using the ThreatConnect v3 API to enrich Indicators, see Indicator Enrichment Overview.

ThreatConnect® is a registered trademark of ThreatConnect, Inc.
DomainTools® and Iris® are registered trademarks of DomainTools, LLC.

20146-07 v.04.A