Domaintools CCF

[RamboV]

Required items, please complete

Change(s):

Added new DomainTools CCF Connector
Reason for Change(s):

New Domain Tools TI CCF Connector
Version Updated:

None
Testing Completed:

Yes
Checked that the validations are passing and have addressed any issues that are present:

See guidance below

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a new DomainTools CCF Microsoft Sentinel solution package, including a CCF data connector, workbook, parsers, and analytic rules.

Changes:

• Added DomainTools CCF solution metadata, release notes, package ARM templates, and createUiDefinition.
• Added CCF data connector definition + poller/DCR/table artifacts, plus workbook and parser.
• Updated global workbook metadata and test validation assets (valid connector IDs, custom table/function schemas).

Reviewed changes

Copilot reviewed 20 out of 24 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
Workbooks/WorkbooksMetadata.json	Registers the new DomainTools workbook in the shared workbook catalog.
Solutions/DomainTools CCF/Workbooks/DomainTools_workbook.json	Adds the DomainTools Threat Intelligence workbook content and KQL visuals.
Solutions/DomainTools CCF/SolutionMetadata.json	Defines solution publisher, offer, support, and categorization metadata.
Solutions/DomainTools CCF/ReleaseNotes.md	Introduces initial release notes entry for the solution.
Solutions/DomainTools CCF/Parsers/DomainToolsThreatIntelDomains.yaml	Adds a KQL function/parser for DomainTools threat domain data.
Solutions/DomainTools CCF/Package/testParameters.json	Adds test parameters for ARM/TTK validation and workbook naming.
Solutions/DomainTools CCF/Package/mainTemplate.json	Adds the deployable ARM template packaging connector/workbook/rules/parser.
Solutions/DomainTools CCF/Package/createUiDefinition.json	Adds Azure Marketplace/Portal UI definition for solution installation.
Solutions/DomainTools CCF/Data/Solution_DomainTools.json	Adds solution manifest referencing included artifacts (rules, workbook, connector, parser).
Solutions/DomainTools CCF/Data Connectors/DomainToolsFeedsLogs_ccf/DomainToolsFeedsLogs_connectorDefinition.json	Adds the CCF connector definition (UI + permissions + instructions).
Solutions/DomainTools CCF/Data Connectors/DomainToolsFeedsLogs_ccf/DomainToolsFeedsLogs_Table.json	Adds the custom table schema for ingested DomainTools domains.
Solutions/DomainTools CCF/Data Connectors/DomainToolsFeedsLogs_ccf/DomainToolsFeedsLogs_PollerConfig.json	Adds poller configurations for NOD/NAD/NOH/DD feeds.
Solutions/DomainTools CCF/Data Connectors/DomainToolsFeedsLogs_ccf/DomainToolsFeedsLogs_DCR.json	Adds the DCR that maps feed streams into the final custom table.
Solutions/DomainTools CCF/Analytic Rules/DomainTools_NewlyObservedHostnames-NOH.yaml	Adds scheduled analytic rule for NOH feed ingestion.
Solutions/DomainTools CCF/Analytic Rules/DomainTools_NewlyObservedDomains-NOD.yaml	Adds scheduled analytic rule for NOD feed ingestion.
Solutions/DomainTools CCF/Analytic Rules/DomainTools_NewlyAddedDomains-NAD.yaml	Adds scheduled analytic rule for NAD feed ingestion.
Solutions/DomainTools CCF/Analytic Rules/DomainTools_DomainDiscovery-DD.yaml	Adds scheduled analytic rule for Domain Discovery feed ingestion.
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json	Adds DomainTools as a valid connectorId for analytic rule validation.
.script/tests/KqlvalidationsTests/CustomTables/DomainToolsThreatIntelDomains_CL.json	Adds custom table schema for KQL validation tests.
.script/tests/KqlvalidationsTests/CustomFunctions/DomainToolsThreatIntelDomains.json	Adds custom function schema for KQL validation tests.

[v-atulyadav]

Hi @RamboV,
Please review the suggestions above and implement the necessary changes accordingly.
Additionally, please share screenshots confirming that the connector has been connected successfully, along with the corresponding invocation logs. Thanks

[v-atulyadav]

Hi @RamboV,
Please review the suggestions above and implement the necessary changes accordingly.

Additionally, please share screenshots confirming that the connector has been connected successfully, along with the corresponding invocation logs for verification. Thanks