↳ GitHub sourceConnector

DomainTools Threat Intelligence Domain Feed

Description

The DomainTools CCF Domain Data Connector retrieves threat-intelligence domain data from multiple DomainTools APIs—including Newly Observed Domains (NOD), Newly Active Domains (NAD), Newly Observed Hostnames (NOH), and Domain Discovery—and ingests it into Microsoft Sentinel for analysis and detection

Declared author / publisher: DomainTools

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

Declared permissions

Read and write permissions are required to ingest data into the Log Analytics workspace.

Workspace

Workspace

DomainTools API Key is Required

To access DomainTools Real Time Feed APIs We need the DomainTools API Key

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

Enter your DomainTools API key.

API Key

Configure DomainTools API

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/DomainTools CCF/Data Connectors/DomainToolsFeedsLogs_ccf/DomainToolsFeedsLogs_connectorDefinition.json ↗
Commit: 629d1d3 ↗
Source identifier: DomainToolsCCFDefinition

Additional source files 2

Solutions/DomainTools CCF/Data Connectors/DomainToolsFeedsLogs_ccf/DomainToolsFeedsLogs_connectorDefinition.jsonsource ↗Solutions/DomainTools CCF/Data/Solution_DomainTools.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.