The latest update for the DomainTools App for Splunk, version 5.0.0, bring additional enrichment capabilities, completely reworked dashboards, a variety of enhancements to make the app easier to use, and a more streamlined installation process. While our dashboards continue to help highlight data of interest, we understand that many users prefer to interact with data on their own dashboards and custom Splunk searches. Learn more about these new features and try out some of our examples.
DomainTools App for Splunk 5.0.0 is the General Availability (GA) release of our app for Splunk, Splunk Enterprise, and Splunk Cloud, with an all new frontend compatible with Splunk's latest guidelines. Please review the release notes to understand the key features and changes in this release.
Implemented Parsed Domain RDAP Feed
Implemented Domain Discovery Feed
Added support for Parsed Domain RDAP API
- RDAP search command
- RDAP dashboard
Updated 206 Responses for Large Datasets
Update Splunk Python-SDK to latest version
Updated to support Splunk SDK for Python (1.7.0). Upgrade to 2.0.2 or later.
WHOIS Sort parameter bug fix
PhishEye Tooltip updated
Support for Newly Active Domains
Support for New Observed Domains
Splunk 5.2 Release Notes:
New
Enrichment dashboard
Top ASN dashboard
Top Registrars dashboard
Top SSL Expired Certificates dashboard
Top Nameservers dashboard
Top ISPs dashboard
Top IP dashboard
Visualization and filters in Enrichment Explorer
Updated
Additional fields in Enrichment Explorer summary view
Error handling for Iris Investigate
Allow multi-value inputs to dtirisenrich command
Enrich history is being populated during normal enrichment process
Enrich history is being populated during monitored enrichment process
New alert for increased risk score
New alert for increased risk score AND risk score greater than threshold
New alert for detect domains
Alerts for ES only are generated
Alerts for Non ES only are generated
Alerts for both ES and Non ES are generated
Alerts for both ES and Non ES are shown correctly in dashboards
New Iris fields are populated during enrichment process
New Iris fields are populated in domain profile
New Iris fields are pivotable
● Punycode domain enrichment error fixed
● Iris Detect Dashboard "Refresh Successful" despite rate limit error corrected
● Domain Profile pivot highlighting on some fields updated
● Extra "0"s on domain profile page removed
● Name Server IP Guided Pivot updated
● React dashboards: sorting by risk score updated
● Recent events panel now shows domains with non-ascii characters
● Updated Enrich script to handle domains with an underscore character
● Provide a function for unescaping URLs
The latest updates, v4.4 and v4.4.1 bring additional enrichment capabilities, completely reworked dashboards, a variety of enhancements to make the app easier to use, and a more streamlined installation process. While our dashboards continue to help highlight data of interest, we understand that many users prefer to interact with data on their own dashboards and custom Splunk searches. Learn more about these new features and try some of our examples.
New:
-Added an inline Passive DNS lookup command, dtdnsdbenrich
-All pages have been rebuilt using SimpleXML and React, resolving HTML dashboard warnings and removing dependencies on older versions of jQuery
Deprecated:
-Removed PhishEye (replaced by Iris Detect)
-Stopped replicating KV stores to indexers (if you miss it, please let us know!)
Changes and Fixes:
-The Iris Detect page has been separated into two pages: an Iris Detect Dashboard and Iris Detect Monitored Term setup page
-Added an inline_results option to dtirisenrich to preserve previous fields
-Resolved an issue that would cause Iris Detect domains to be imported into Splunk, regardless of whether or not a monitored term was enabled
-Resolved an issue on Splunk 9 when Iris Detect domains would not be imported at all
-Domains with parsing issues are logged (if Diagnostic Panel is enabled) and skipped, resolving a queue builder error in some environments
-Improved in-app documentation and syntax highlighting on custom search commands
New:
- Manage previously-ignored Iris Detect Monitor alerts within Splunk (API Functionality Required)
- Improved checks for invalid domains, skipping and logging them (if enabled) during enrichment
Changes and Fixes:
- Fixes support for proxy usage broken in 4.3
- Fixes a parsing error on the DNSDB Flexible Search page when using regexes
- Fixes a display issue for the Risk Score panel on the Domain Profile page
- Updated DomainTools branding
New:
• Triage new domains matching Iris Detect Monitors within Splunk (API Functionality Required)
• Synchronize the Iris Detect Watch List with the Splunk Monitoring list to watch for new domain activity within your environment
• Investigate domain infrastructure with Passive DNS (pDNS) using Farsight’s DNSDB Standard or Flexible search (API Key Required)
Changes and Fixes:
• Removed Python 2 support due to updated dependent libraries
• Added a distributed search configuration to address occasional issues when updating in Splunk Cloud
• Slightly lowered the default risk score thresholds used in the Enrichment Settings page. This does not override any user-specified thresholds when doing an in-place upgrade
• Simplified the DT Settings Menu. Moved Monitoring-specific settings under a new Monitoring menu
• Replaced HTML dashboards with single page apps to maintain Splunk Cloud compatibility
• Updated to jQuery v3.6
• Minor fixes and UI polishing
Fix:
• Adds a trigger stanza in app.conf to avoid unnecessary "restart required" messages.
New
• Power an always-on SOC display with auto-refreshing Threat Profile and Monitoring dashboard panels
• Simplify your triage process, investigating domains flagged in Enterprise Security Incident Review within the DomainTools app Domain Profile page
• Improve app performance using a new regex-based dtdomainextract2 macro
• Expedite your workflow, adding domains to monitoring or allow-lists directly from DomainTools Enrichment Explorer
• Natively enrich logs containing multivalue URLs (most commonly encountered with Proofpoint)
Changes and Fixes
• To improve performance, logging has been disabled by default. It can be re-enabled in the Diagnostic Panel
• Allows for “Informational”-level urgency tags when creating Notable Events in Enterprise Security
• Expanded configuration levels for allow-list actions
• Improved in-app documentation and user guide
• See the user guide for additional changes
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.