![](\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/DomainTools.svg\"width=\"75px\"height=\"75px\")
",
+ "Description": "The [Domaintools Threat Intelligence Feeds](https://www.domaintools.com/products/threat-intelligence-feeds/) solution for Microsoft Sentinel contains CCF-based data connector that ingests domain-related threat intelligence from Domain tools including Newly Observed Domains (NOD), Newly Observed Hostnames (NOH), Newly Active Domains (NAD), and Domain Discovery. The solution also provides an analytic rule that automatically creates incidents when new domains are ingested, enabling security teams to quickly detect and investigate potentially malicious domains. In addition, a workbook is included to visualize domain activity, ingestion trends, and correlations with security telemetry, helping SOC analysts improve threat detection and response.",
+ "Analytic Rules": [
+ "Solutions/DomainTools CCF/Analytic Rules/DomainTools_DomainDiscovery-DD.yaml",
+ "Solutions/DomainTools CCF/Analytic Rules/DomainTools_NewlyAddedDomains-NAD.yaml",
+ "Solutions/DomainTools CCF/Analytic Rules/DomainTools_NewlyObservedDomains-NOD.yaml",
+ "Solutions/DomainTools CCF/Analytic Rules/DomainTools_NewlyObservedHostnames-NOH.yaml"
+ ],
+ "WorkbookDescription": "DomainTools Threat Intelligence Workbook",
+ "WorkbookBladeDescription": "DomainTools Threat Intelligence Workbook",
+ "AnalyticalRuleBladeDescription": "DomainTools Threat Intelligence Rules",
+ "Workbooks": [
+ "Solutions/DomainTools CCF/Workbooks/DomainTools_workbook.json"
+ ],
+ "Data Connectors": [
+ "Data Connectors/DomainToolsFeedsLogs_ccf/DomainToolsFeedsLogs_connectorDefinition.json"
+ ],
+ "Parsers": [
+ "Solutions/DomainTools CCF/Parsers/DomainToolsThreatIntelDomains.yaml"
+ ],
+ "Metadata": "SolutionMetadata.json",
+ "BasePath": "D:\\Azure-Sentinel\\Solutions\\DomainTools CCF",
+ "Version": "3.0.0",
+ "TemplateSpec": true
+}
\ No newline at end of file
diff --git a/Solutions/DomainTools CCF/Package/3.0.0.zip b/Solutions/DomainTools CCF/Package/3.0.0.zip
new file mode 100644
index 00000000000..d71dd1a69b8
Binary files /dev/null and b/Solutions/DomainTools CCF/Package/3.0.0.zip differ
diff --git a/Solutions/DomainTools CCF/Package/createUiDefinition.json b/Solutions/DomainTools CCF/Package/createUiDefinition.json
new file mode 100644
index 00000000000..fe05822e973
--- /dev/null
+++ b/Solutions/DomainTools CCF/Package/createUiDefinition.json
@@ -0,0 +1,211 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
+ "handler": "Microsoft.Azure.CreateUIDef",
+ "version": "0.1.2-preview",
+ "parameters": {
+ "config": {
+ "isWizard": false,
+ "basics": {
+ "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/DomainTools%20CCF/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Domaintools Threat Intelligence Feeds](https://www.domaintools.com/products/threat-intelligence-feeds/) solution for Microsoft Sentinel contains CCF-based data connector that ingests domain-related threat intelligence from Domain tools including Newly Observed Domains (NOD), Newly Observed Hostnames (NOH), Newly Active Domains (NAD), and Domain Discovery. The solution also provides an analytic rule that automatically creates incidents when new domains are ingested, enabling security teams to quickly detect and investigate potentially malicious domains. In addition, a workbook is included to visualize domain activity, ingestion trends, and correlations with security telemetry, helping SOC analysts improve threat detection and response.\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 4\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+ "subscription": {
+ "resourceProviders": [
+ "Microsoft.OperationsManagement/solutions",
+ "Microsoft.OperationalInsights/workspaces/providers/alertRules",
+ "Microsoft.Insights/workbooks",
+ "Microsoft.Logic/workflows"
+ ]
+ },
+ "location": {
+ "metadata": {
+ "hidden": "Hiding location, we get it from the log analytics workspace"
+ },
+ "visible": false
+ },
+ "resourceGroup": {
+ "allowExisting": true
+ }
+ }
+ },
+ "basics": [
+ {
+ "name": "getLAWorkspace",
+ "type": "Microsoft.Solutions.ArmApiControl",
+ "toolTip": "This filters by workspaces that exist in the Resource Group selected",
+ "condition": "[greater(length(resourceGroup().name),0)]",
+ "request": {
+ "method": "GET",
+ "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]"
+ }
+ },
+ {
+ "name": "workspace",
+ "type": "Microsoft.Common.DropDown",
+ "label": "Workspace",
+ "placeholder": "Select a workspace",
+ "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected",
+ "constraints": {
+ "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]",
+ "required": true
+ },
+ "visible": true
+ }
+ ],
+ "steps": [
+ {
+ "name": "dataconnectors",
+ "label": "Data Connectors",
+ "bladeTitle": "Data Connectors",
+ "elements": [
+ {
+ "name": "dataconnectors1-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "This Solution installs the data connector for DomainTools Threat Intelligence Domain Feed. You can get DomainTools Threat Intelligence Domain Feed data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
+ }
+ },
+ {
+ "name": "dataconnectors-link1",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "link": {
+ "label": "Learn more about connecting data sources",
+ "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources"
+ }
+ }
+ }
+ ]
+ },
+ {
+ "name": "workbooks",
+ "label": "Workbooks",
+ "subLabel": {
+ "preValidation": "Configure the workbooks",
+ "postValidation": "Done"
+ },
+ "bladeTitle": "Workbooks",
+ "elements": [
+ {
+ "name": "workbooks-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "DomainTools Threat Intelligence Workbook"
+ }
+ },
+ {
+ "name": "workbooks-link",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "link": {
+ "label": "Learn more",
+ "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data"
+ }
+ }
+ },
+ {
+ "name": "workbook1",
+ "type": "Microsoft.Common.Section",
+ "label": "DomainTools Threat Intelligence CCF Dashboards",
+ "elements": [
+ {
+ "name": "workbook1-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "# DomainTools CCF workbook provides insights into domains flagged by DomainTools, their ingestion frequency, domain types."
+ }
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "name": "analytics",
+ "label": "Analytics",
+ "subLabel": {
+ "preValidation": "Configure the analytics",
+ "postValidation": "Done"
+ },
+ "bladeTitle": "Analytics",
+ "elements": [
+ {
+ "name": "analytics-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "DomainTools Threat Intelligence Rules"
+ }
+ },
+ {
+ "name": "analytics-link",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "link": {
+ "label": "Learn more",
+ "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef"
+ }
+ }
+ },
+ {
+ "name": "analytic1",
+ "type": "Microsoft.Common.Section",
+ "label": "DomainTools New Domain Discovery Indicators Ingested",
+ "elements": [
+ {
+ "name": "analytic1-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "Creates an incident whenever DomainTools Domain Discovery new indicators (domains) are ingested in the last 1 hour."
+ }
+ }
+ ]
+ },
+ {
+ "name": "analytic2",
+ "type": "Microsoft.Common.Section",
+ "label": "DomainTools Newly Added Domains Feeds Ingested",
+ "elements": [
+ {
+ "name": "analytic2-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "Creates an incident whenever DomainTools Domain Discovery new Feeds (domains) are ingested in the last 1 hour."
+ }
+ }
+ ]
+ },
+ {
+ "name": "analytic3",
+ "type": "Microsoft.Common.Section",
+ "label": "DomainTools Newly Observed Domains Feeds Ingested",
+ "elements": [
+ {
+ "name": "analytic3-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "Creates an incident whenever DomainTools Newly Observed Domains new Feeds (domains) are ingested in the last 1 hour."
+ }
+ }
+ ]
+ },
+ {
+ "name": "analytic4",
+ "type": "Microsoft.Common.Section",
+ "label": "DomainTools Newly Observed Hostnames Feeds Ingested",
+ "elements": [
+ {
+ "name": "analytic4-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "Creates an incident whenever DomainTools Newly Observed Hostnames new Feeds (domains) are ingested in the last 1 hour."
+ }
+ }
+ ]
+ }
+ ]
+ }
+ ],
+ "outputs": {
+ "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
+ "location": "[location()]",
+ "workspace": "[basics('workspace')]"
+ }
+ }
+}
diff --git a/Solutions/DomainTools CCF/Package/mainTemplate.json b/Solutions/DomainTools CCF/Package/mainTemplate.json
new file mode 100644
index 00000000000..73b04d99062
--- /dev/null
+++ b/Solutions/DomainTools CCF/Package/mainTemplate.json
@@ -0,0 +1,1521 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "metadata": {
+ "author": "DomainTools - memberservices@domaintools.com",
+ "comments": "Solution template for DomainTools CCF"
+ },
+ "parameters": {
+ "location": {
+ "type": "string",
+ "minLength": 1,
+ "defaultValue": "[resourceGroup().location]",
+ "metadata": {
+ "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace"
+ }
+ },
+ "workspace-location": {
+ "type": "string",
+ "defaultValue": "[resourceGroup().location]",
+ "metadata": {
+ "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"
+ }
+ },
+ "workspace": {
+ "defaultValue": "Your Workspace Name",
+ "type": "string",
+ "metadata": {
+ "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
+ }
+ },
+ "workbook1-name": {
+ "type": "string",
+ "defaultValue": "DomainTools Threat Intelligence CCF Dashboards",
+ "minLength": 1,
+ "metadata": {
+ "description": "Name for the workbook"
+ }
+ },
+ "resourceGroupName": {
+ "type": "string",
+ "defaultValue": "[resourceGroup().name]",
+ "metadata": {
+ "description": "resource group name where Microsoft Sentinel is setup"
+ }
+ },
+ "subscription": {
+ "type": "string",
+ "defaultValue": "[last(split(subscription().id, '/'))]",
+ "metadata": {
+ "description": "subscription id where Microsoft Sentinel is setup"
+ }
+ }
+ },
+ "variables": {
+ "email": "memberservices@domaintools.com",
+ "_email": "[variables('email')]",
+ "_solutionName": "DomainTools CCF",
+ "_solutionVersion": "3.0.0",
+ "solutionId": "domaintoolsccf.azure-sentinel-solution-domaintools-threatintel",
+ "_solutionId": "[variables('solutionId')]",
+ "analyticRuleObject1": {
+ "analyticRuleVersion1": "1.0.0",
+ "_analyticRulecontentId1": "f8c223c1-1a28-4b28-8e9f-5e33b610916b",
+ "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f8c223c1-1a28-4b28-8e9f-5e33b610916b')]",
+ "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f8c223c1-1a28-4b28-8e9f-5e33b610916b')))]",
+ "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f8c223c1-1a28-4b28-8e9f-5e33b610916b','-', '1.0.0')))]"
+ },
+ "analyticRuleObject2": {
+ "analyticRuleVersion2": "1.0.0",
+ "_analyticRulecontentId2": "f8c223c1-1a28-4b28-8e9f-5e34b610916b",
+ "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f8c223c1-1a28-4b28-8e9f-5e34b610916b')]",
+ "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f8c223c1-1a28-4b28-8e9f-5e34b610916b')))]",
+ "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f8c223c1-1a28-4b28-8e9f-5e34b610916b','-', '1.0.0')))]"
+ },
+ "analyticRuleObject3": {
+ "analyticRuleVersion3": "1.0.0",
+ "_analyticRulecontentId3": "f8c223c1-1a28-4b28-8e9f-5e35b610916b",
+ "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f8c223c1-1a28-4b28-8e9f-5e35b610916b')]",
+ "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f8c223c1-1a28-4b28-8e9f-5e35b610916b')))]",
+ "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f8c223c1-1a28-4b28-8e9f-5e35b610916b','-', '1.0.0')))]"
+ },
+ "analyticRuleObject4": {
+ "analyticRuleVersion4": "1.0.0",
+ "_analyticRulecontentId4": "f8c223c1-1a28-4b28-8e9f-5e36b610916b",
+ "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f8c223c1-1a28-4b28-8e9f-5e36b610916b')]",
+ "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f8c223c1-1a28-4b28-8e9f-5e36b610916b')))]",
+ "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f8c223c1-1a28-4b28-8e9f-5e36b610916b','-', '1.0.0')))]"
+ },
+ "workbookVersion1": "1.0",
+ "workbookContentId1": "DomainToolCCFWorkbook",
+ "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]",
+ "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]",
+ "_workbookContentId1": "[variables('workbookContentId1')]",
+ "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
+ "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]",
+ "dataConnectorCCPVersion": "1.0.0",
+ "_dataConnectorContentIdConnectorDefinition1": "DomainToolsCCFDefinition",
+ "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]",
+ "_dataConnectorContentIdConnections1": "DomainToolsCCFDefinitionConnections",
+ "dataConnectorTemplateNameConnections1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections1')))]",
+ "dataCollectionEndpointId1": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]",
+ "blanks": "[replace('b', 'b', '')]",
+ "TemplateEmptyObject": "[json('{}')]",
+ "parserObject1": {
+ "_parserName1": "[concat(parameters('workspace'),'/','DomainToolsThreatIntelDomains')]",
+ "_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'DomainToolsThreatIntelDomains')]",
+ "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('DomainToolsThreatIntelDomains-Parser')))]",
+ "parserVersion1": "1.0.0",
+ "parserContentId1": "DomainToolsThreatIntelDomains-Parser"
+ },
+ "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
+ },
+ "resources": [
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "DomainTools_DomainDiscovery-DD_AnalyticalRules Analytics Rule with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+ "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+ "apiVersion": "2023-02-01-preview",
+ "kind": "Scheduled",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "description": "Creates an incident whenever DomainTools Domain Discovery new indicators (domains) are ingested in the last 1 hour.",
+ "displayName": "DomainTools New Domain Discovery Indicators Ingested",
+ "enabled": false,
+ "query": "DomainToolsThreatIntelDomains(1h,\"domaindiscovery\")",
+ "queryFrequency": "PT1H",
+ "queryPeriod": "PT1H",
+ "severity": "Medium",
+ "suppressionDuration": "PT1H",
+ "suppressionEnabled": false,
+ "triggerOperator": "GreaterThan",
+ "triggerThreshold": 0,
+ "status": "Available",
+ "requiredDataConnectors": [
+ {
+ "connectorId": "DomainTools",
+ "dataTypes": [
+ "DomainToolsThreatIntelDomains_CL"
+ ]
+ }
+ ],
+ "entityMappings": [
+ {
+ "entityType": "DNS",
+ "fieldMappings": [
+ {
+ "identifier": "DomainName",
+ "columnName": "DomainCustomEntity"
+ }
+ ]
+ }
+ ],
+ "eventGroupingSettings": {
+ "aggregationKind": "SingleAlert"
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]",
+ "properties": {
+ "description": "DomainTools CCF Analytics Rule 1",
+ "parentId": "[variables('analyticRuleObject1').analyticRuleId1]",
+ "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+ "kind": "AnalyticsRule",
+ "version": "[variables('analyticRuleObject1').analyticRuleVersion1]",
+ "source": {
+ "kind": "Solution",
+ "name": "DomainTools CCF",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "DomainTools",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "tier": "Partner",
+ "name": "DomainTools",
+ "email": "memberservices@domaintools.com",
+ "link": "https://www.domaintools.com/support/"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+ "contentKind": "AnalyticsRule",
+ "displayName": "DomainTools New Domain Discovery Indicators Ingested",
+ "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]",
+ "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]",
+ "version": "[variables('analyticRuleObject1').analyticRuleVersion1]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('analyticRuleObject2').analyticRuleTemplateSpecName2]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "DomainTools_NewlyAddedDomains-NAD_AnalyticalRules Analytics Rule with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+ "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
+ "apiVersion": "2023-02-01-preview",
+ "kind": "Scheduled",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "description": "Creates an incident whenever DomainTools Domain Discovery new Feeds (domains) are ingested in the last 1 hour.",
+ "displayName": "DomainTools Newly Added Domains Feeds Ingested",
+ "enabled": false,
+ "query": "DomainToolsThreatIntelDomains(1h,\"nad\")",
+ "queryFrequency": "PT1H",
+ "queryPeriod": "PT1H",
+ "severity": "Medium",
+ "suppressionDuration": "PT1H",
+ "suppressionEnabled": false,
+ "triggerOperator": "GreaterThan",
+ "triggerThreshold": 0,
+ "status": "Available",
+ "requiredDataConnectors": [
+ {
+ "connectorId": "DomainTools",
+ "dataTypes": [
+ "DomainToolsThreatIntelDomains_CL"
+ ]
+ }
+ ],
+ "entityMappings": [
+ {
+ "entityType": "DNS",
+ "fieldMappings": [
+ {
+ "identifier": "DomainName",
+ "columnName": "DomainCustomEntity"
+ }
+ ]
+ }
+ ],
+ "eventGroupingSettings": {
+ "aggregationKind": "SingleAlert"
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject2').analyticRuleId2,'/'))))]",
+ "properties": {
+ "description": "DomainTools CCF Analytics Rule 2",
+ "parentId": "[variables('analyticRuleObject2').analyticRuleId2]",
+ "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
+ "kind": "AnalyticsRule",
+ "version": "[variables('analyticRuleObject2').analyticRuleVersion2]",
+ "source": {
+ "kind": "Solution",
+ "name": "DomainTools CCF",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "DomainTools",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "tier": "Partner",
+ "name": "DomainTools",
+ "email": "memberservices@domaintools.com",
+ "link": "https://www.domaintools.com/support/"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
+ "contentKind": "AnalyticsRule",
+ "displayName": "DomainTools Newly Added Domains Feeds Ingested",
+ "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]",
+ "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]",
+ "version": "[variables('analyticRuleObject2').analyticRuleVersion2]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('analyticRuleObject3').analyticRuleTemplateSpecName3]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "DomainTools_NewlyObservedDomains-NOD_AnalyticalRules Analytics Rule with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+ "name": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
+ "apiVersion": "2023-02-01-preview",
+ "kind": "Scheduled",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "description": "Creates an incident whenever DomainTools Newly Observed Domains new Feeds (domains) are ingested in the last 1 hour.",
+ "displayName": "DomainTools Newly Observed Domains Feeds Ingested",
+ "enabled": false,
+ "query": "DomainToolsThreatIntelDomains(1h, \"nod\")",
+ "queryFrequency": "PT1H",
+ "queryPeriod": "PT1H",
+ "severity": "Medium",
+ "suppressionDuration": "PT1H",
+ "suppressionEnabled": false,
+ "triggerOperator": "GreaterThan",
+ "triggerThreshold": 0,
+ "status": "Available",
+ "requiredDataConnectors": [
+ {
+ "connectorId": "DomainTools",
+ "dataTypes": [
+ "DomainToolsThreatIntelDomains_CL"
+ ]
+ }
+ ],
+ "entityMappings": [
+ {
+ "entityType": "DNS",
+ "fieldMappings": [
+ {
+ "identifier": "DomainName",
+ "columnName": "DomainCustomEntity"
+ }
+ ]
+ }
+ ],
+ "eventGroupingSettings": {
+ "aggregationKind": "SingleAlert"
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject3').analyticRuleId3,'/'))))]",
+ "properties": {
+ "description": "DomainTools CCF Analytics Rule 3",
+ "parentId": "[variables('analyticRuleObject3').analyticRuleId3]",
+ "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
+ "kind": "AnalyticsRule",
+ "version": "[variables('analyticRuleObject3').analyticRuleVersion3]",
+ "source": {
+ "kind": "Solution",
+ "name": "DomainTools CCF",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "DomainTools",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "tier": "Partner",
+ "name": "DomainTools",
+ "email": "memberservices@domaintools.com",
+ "link": "https://www.domaintools.com/support/"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
+ "contentKind": "AnalyticsRule",
+ "displayName": "DomainTools Newly Observed Domains Feeds Ingested",
+ "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]",
+ "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]",
+ "version": "[variables('analyticRuleObject3').analyticRuleVersion3]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('analyticRuleObject4').analyticRuleTemplateSpecName4]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "DomainTools_NewlyObservedHostnames-NOH_AnalyticalRules Analytics Rule with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+ "name": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
+ "apiVersion": "2023-02-01-preview",
+ "kind": "Scheduled",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "description": "Creates an incident whenever DomainTools Newly Observed Hostnames new Feeds (domains) are ingested in the last 1 hour.",
+ "displayName": "DomainTools Newly Observed Hostnames Feeds Ingested",
+ "enabled": false,
+ "query": "DomainToolsThreatIntelDomains(1h, \"noh\")",
+ "queryFrequency": "PT1H",
+ "queryPeriod": "PT1H",
+ "severity": "Medium",
+ "suppressionDuration": "PT1H",
+ "suppressionEnabled": false,
+ "triggerOperator": "GreaterThan",
+ "triggerThreshold": 0,
+ "status": "Available",
+ "requiredDataConnectors": [
+ {
+ "connectorId": "DomainTools",
+ "dataTypes": [
+ "DomainToolsThreatIntelDomains_CL"
+ ]
+ }
+ ],
+ "entityMappings": [
+ {
+ "entityType": "DNS",
+ "fieldMappings": [
+ {
+ "identifier": "DomainName",
+ "columnName": "DomainCustomEntity"
+ }
+ ]
+ }
+ ],
+ "eventGroupingSettings": {
+ "aggregationKind": "SingleAlert"
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject4').analyticRuleId4,'/'))))]",
+ "properties": {
+ "description": "DomainTools CCF Analytics Rule 4",
+ "parentId": "[variables('analyticRuleObject4').analyticRuleId4]",
+ "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
+ "kind": "AnalyticsRule",
+ "version": "[variables('analyticRuleObject4').analyticRuleVersion4]",
+ "source": {
+ "kind": "Solution",
+ "name": "DomainTools CCF",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "DomainTools",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "tier": "Partner",
+ "name": "DomainTools",
+ "email": "memberservices@domaintools.com",
+ "link": "https://www.domaintools.com/support/"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
+ "contentKind": "AnalyticsRule",
+ "displayName": "DomainTools Newly Observed Hostnames Feeds Ingested",
+ "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]",
+ "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]",
+ "version": "[variables('analyticRuleObject4').analyticRuleVersion4]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('workbookTemplateSpecName1')]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "DomainTools_workbook Workbook with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('workbookVersion1')]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "type": "Microsoft.Insights/workbooks",
+ "name": "[variables('workbookContentId1')]",
+ "location": "[parameters('workspace-location')]",
+ "kind": "shared",
+ "apiVersion": "2021-08-01",
+ "metadata": {
+ "description": "# DomainTools CCF workbook provides insights into domains flagged by DomainTools, their ingestion frequency, domain types."
+ },
+ "properties": {
+ "displayName": "[parameters('workbook1-name')]",
+ "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# DomainTools Threat Intelligence Dashboard\\nVisualize and correlate DomainTools threat domain data.\\n---\\n\\nThis workbook provides insights into domains flagged by DomainTools, their ingestion frequency, domain types.\"},\"name\":\"Header\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DomainToolsThreatIntelDomains_CL\\n| where TimeGenerated > ago(12h)\\n| summarize Count = count() by bin(TimeGenerated, 1h), domaintype\\n| order by TimeGenerated asc\\n| render barchart\",\"size\":0,\"title\":\"Domains in Last 12 Hours\",\"timeContext\":{\"durationMs\":172800000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"name\":\"Last12HourDomains\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DomainToolsThreatIntelDomains_CL\\n| summarize Count = count() by domaintype\\n| render piechart\",\"size\":3,\"title\":\"Domain Count by Type\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"DomainTypePie\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DomainToolsThreatIntelDomains_CL\\n| summarize TotalDomains = count(), LatestIngestion = max(TimeGenerated)\",\"size\":4,\"title\":\"Overview: Ingested Domains Summary\",\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"labelSettings\":[{\"columnId\":\"TotalDomains\",\"label\":\"Total Domains Ingested\"},{\"columnId\":\"LatestIngestion\",\"label\":\"Recent Ingestion Date & Time\"}]}},\"customWidth\":\"50\",\"name\":\"Summary\",\"styleSettings\":{\"maxWidth\":\"50%\"}}],\"fromTemplateId\":\"sentinel-Workbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n",
+ "version": "1.0",
+ "sourceId": "[variables('workspaceResourceId')]",
+ "category": "sentinel"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]",
+ "properties": {
+ "description": "@{workbookKey=DomainToolCCFWorkbook; logoFileName=DomainTools.svg; description=# DomainTools CCF workbook provides insights into domains flagged by DomainTools, their ingestion frequency, domain types.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0; title=DomainTools Threat Intelligence CCF Dashboards; templateRelativePath=DomainTools_workbook.json; subtitle=; provider=DomainTools}.description",
+ "parentId": "[variables('workbookId1')]",
+ "contentId": "[variables('_workbookContentId1')]",
+ "kind": "Workbook",
+ "version": "[variables('workbookVersion1')]",
+ "source": {
+ "kind": "Solution",
+ "name": "DomainTools CCF",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "DomainTools",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "tier": "Partner",
+ "name": "DomainTools",
+ "email": "memberservices@domaintools.com",
+ "link": "https://www.domaintools.com/support/"
+ },
+ "dependencies": {
+ "operator": "AND",
+ "criteria": [
+ {
+ "contentId": "DomainToolsThreatIntelDomains_CL",
+ "kind": "DataType"
+ },
+ {
+ "contentId": "DomainToolsCCFDefinition",
+ "kind": "DataConnector"
+ }
+ ]
+ }
+ },
+ "description": "DomainTools Threat Intelligence Workbook"
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('_workbookContentId1')]",
+ "contentKind": "Workbook",
+ "displayName": "[parameters('workbook1-name')]",
+ "contentProductId": "[variables('_workbookcontentProductId1')]",
+ "id": "[variables('_workbookcontentProductId1')]",
+ "version": "[variables('workbookVersion1')]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition1'), variables('dataConnectorCCPVersion'))]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]",
+ "displayName": "DomainTools Threat Intelligence Domain Feed",
+ "contentKind": "DataConnector",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('dataConnectorCCPVersion')]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]",
+ "apiVersion": "2022-09-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
+ "location": "[parameters('workspace-location')]",
+ "kind": "Customizable",
+ "properties": {
+ "connectorUiConfig": {
+ "id": "DomainToolsCCFDefinition",
+ "title": "DomainTools Threat Intelligence Domain Feed",
+ "publisher": "DomainTools",
+ "descriptionMarkdown": "The DomainTools CCF Domain Data Connector retrieves threat-intelligence domain data from multiple DomainTools APIs—including Newly Observed Domains (NOD), Newly Active Domains (NAD), Newly Observed Hostnames (NOH), and Domain Discovery—and ingests it into Microsoft Sentinel for analysis and detection",
+ "graphQueriesTableName": "DomainToolsThreatIntelDomains_CL",
+ "graphQueries": [
+ {
+ "metricName": "Total domains",
+ "legend": "DomainTools Threat Intelligence",
+ "baseQuery": "{{graphQueriesTableName}}"
+ }
+ ],
+ "sampleQueries": [
+ {
+ "description": "All Domains",
+ "query": "{{graphQueriesTableName}} | sort by TimeGenerated desc"
+ }
+ ],
+ "dataTypes": [
+ {
+ "name": "{{graphQueriesTableName}}",
+ "lastDataReceivedQuery": "{{graphQueriesTableName}} |summarize Time = max(TimeGenerated) | where isnotempty(Time)"
+ }
+ ],
+ "connectivityCriteria": [
+ {
+ "type": "HasDataConnectors"
+ }
+ ],
+ "availability": {
+ "isPreview": false
+ },
+ "permissions": {
+ "resourceProvider": [
+ {
+ "provider": "Microsoft.OperationalInsights/workspaces",
+ "permissionsDisplayText": "Read and write permissions are required to ingest data into the Log Analytics workspace.",
+ "providerDisplayName": "Workspace",
+ "scope": "Workspace",
+ "requiredPermissions": {
+ "read": true,
+ "write": true,
+ "delete": true
+ }
+ }
+ ],
+ "customs": [
+ {
+ "name": "Domain Tools API Key is Required",
+ "description": "To access DomainTools Real Time Feed APIs We need the DomainTools API Key "
+ }
+ ]
+ },
+ "instructionSteps": [
+ {
+ "description": "Enter your DomainTools API key.",
+ "instructions": [
+ {
+ "type": "Textbox",
+ "parameters": {
+ "label": "API Key",
+ "name": "apiKey",
+ "type": "password",
+ "placeholder": "Enter your DomainTools API Key",
+ "validations": {
+ "required": true
+ }
+ }
+ },
+ {
+ "type": "ConnectionToggleButton",
+ "parameters": {
+ "connectLabel": "connect",
+ "name": "toggle"
+ }
+ }
+ ],
+ "title": "Configure DomainTools API"
+ }
+ ]
+ }
+ }
+ },
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]",
+ "apiVersion": "2022-01-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "properties": {
+ "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]",
+ "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]",
+ "kind": "DataConnector",
+ "version": "[variables('dataConnectorCCPVersion')]",
+ "source": {
+ "sourceId": "[variables('_solutionId')]",
+ "name": "[variables('_solutionName')]",
+ "kind": "Solution"
+ },
+ "author": {
+ "name": "DomainTools",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "tier": "Partner",
+ "name": "DomainTools",
+ "email": "memberservices@domaintools.com",
+ "link": "https://www.domaintools.com/support/"
+ },
+ "dependencies": {
+ "criteria": [
+ {
+ "version": "[variables('dataConnectorCCPVersion')]",
+ "contentId": "[variables('_dataConnectorContentIdConnections1')]",
+ "kind": "ResourcesDataConnector"
+ }
+ ]
+ }
+ }
+ },
+ {
+ "name": "DomainToolsDCR",
+ "apiVersion": "2022-06-01",
+ "type": "Microsoft.Insights/dataCollectionRules",
+ "location": "[parameters('workspace-location')]",
+ "kind": "[variables('blanks')]",
+ "properties": {
+ "dataCollectionEndpointId": "[variables('dataCollectionEndpointId1')]",
+ "workspaceResourceId": "{{workspaceResourceId}}",
+ "streamDeclarations": {
+ "Custom-DomainToolsThreatIntel_NOD_CL": {
+ "columns": [
+ {
+ "name": "timestamp",
+ "type": "string",
+ "description": "Timestamp"
+ },
+ {
+ "name": "domain",
+ "type": "string",
+ "description": "Domain"
+ }
+ ]
+ },
+ "Custom-DomainToolsThreatIntel_NOH_CL": {
+ "columns": [
+ {
+ "name": "timestamp",
+ "type": "string",
+ "description": "Timestamp"
+ },
+ {
+ "name": "domain",
+ "type": "string",
+ "description": "Domain"
+ }
+ ]
+ },
+ "Custom-DomainToolsThreatIntel_NAD_CL": {
+ "columns": [
+ {
+ "name": "timestamp",
+ "type": "string",
+ "description": "Timestamp"
+ },
+ {
+ "name": "domain",
+ "type": "string",
+ "description": "Domain"
+ }
+ ]
+ },
+ "Custom-DomainToolsThreatIntel_DD_CL": {
+ "columns": [
+ {
+ "name": "timestamp",
+ "type": "string",
+ "description": "Timestamp"
+ },
+ {
+ "name": "domain",
+ "type": "string",
+ "description": "Domain"
+ }
+ ]
+ }
+ },
+ "dataSources": "[variables('TemplateEmptyObject')]",
+ "destinations": {
+ "logAnalytics": [
+ {
+ "name": "dtv2ws1",
+ "workspaceResourceId": "[variables('workspaceResourceId')]"
+ }
+ ]
+ },
+ "dataFlows": [
+ {
+ "streams": [
+ "Custom-DomainToolsThreatIntel_NOD_CL"
+ ],
+ "destinations": [
+ "dtv2ws1"
+ ],
+ "transformKql": "source \n| extend TimeGenerated = todatetime(timestamp), domaintype = 'nod'\n\n",
+ "outputStream": "Custom-DomainToolsThreatIntelDomains_CL"
+ },
+ {
+ "streams": [
+ "Custom-DomainToolsThreatIntel_NOH_CL"
+ ],
+ "destinations": [
+ "dtv2ws1"
+ ],
+ "transformKql": "source \n| extend TimeGenerated = todatetime(timestamp), domaintype = 'noh'\n\n",
+ "outputStream": "Custom-DomainToolsThreatIntelDomains_CL"
+ },
+ {
+ "streams": [
+ "Custom-DomainToolsThreatIntel_NAD_CL"
+ ],
+ "destinations": [
+ "dtv2ws1"
+ ],
+ "transformKql": "source \n| extend TimeGenerated = todatetime(timestamp), domaintype = 'nad'\n\n",
+ "outputStream": "Custom-DomainToolsThreatIntelDomains_CL"
+ },
+ {
+ "streams": [
+ "Custom-DomainToolsThreatIntel_DD_CL"
+ ],
+ "destinations": [
+ "dtv2ws1"
+ ],
+ "transformKql": "source \n| extend TimeGenerated = todatetime(timestamp), domaintype = 'domaindiscovery'\n\n",
+ "outputStream": "Custom-DomainToolsThreatIntelDomains_CL"
+ }
+ ],
+ "provisioningState": "Succeeded"
+ }
+ },
+ {
+ "name": "DomainToolsThreatIntelDomains_CL",
+ "apiVersion": "2022-10-01",
+ "type": "Microsoft.OperationalInsights/workspaces/tables",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "retentionInDays": 30,
+ "schema": {
+ "name": "DomainToolsThreatIntelDomains_CL",
+ "tableType": "CustomLog",
+ "columns": [
+ {
+ "name": "timestamp",
+ "type": "String",
+ "description": "Timestamp"
+ },
+ {
+ "name": "domain",
+ "type": "String",
+ "description": "Domain"
+ },
+ {
+ "name": "domaintype",
+ "type": "String",
+ "description": "Type of domain data (nod, noh, nad, domaindiscovery)"
+ },
+ {
+ "name": "TimeGenerated",
+ "type": "DateTime",
+ "isDefaultDisplay": true,
+ "description": "The timestamp (UTC) reflecting the time in which the event was generated."
+ }
+ ],
+ "isTroubleshootingAllowed": true
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition1'),'-', variables('dataConnectorCCPVersion'))))]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "version": "[variables('dataConnectorCCPVersion')]"
+ }
+ },
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]",
+ "apiVersion": "2022-09-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
+ "location": "[parameters('workspace-location')]",
+ "kind": "Customizable",
+ "properties": {
+ "connectorUiConfig": {
+ "id": "DomainToolsCCFDefinition",
+ "title": "DomainTools Threat Intelligence Domain Feed",
+ "publisher": "DomainTools",
+ "descriptionMarkdown": "The DomainTools CCF Domain Data Connector retrieves threat-intelligence domain data from multiple DomainTools APIs—including Newly Observed Domains (NOD), Newly Active Domains (NAD), Newly Observed Hostnames (NOH), and Domain Discovery—and ingests it into Microsoft Sentinel for analysis and detection",
+ "graphQueriesTableName": "DomainToolsThreatIntelDomains_CL",
+ "graphQueries": [
+ {
+ "metricName": "Total domains",
+ "legend": "DomainTools Threat Intelligence",
+ "baseQuery": "{{graphQueriesTableName}}"
+ }
+ ],
+ "sampleQueries": [
+ {
+ "description": "All Domains",
+ "query": "{{graphQueriesTableName}} | sort by TimeGenerated desc"
+ }
+ ],
+ "dataTypes": [
+ {
+ "name": "{{graphQueriesTableName}}",
+ "lastDataReceivedQuery": "{{graphQueriesTableName}} |summarize Time = max(TimeGenerated) | where isnotempty(Time)"
+ }
+ ],
+ "connectivityCriteria": [
+ {
+ "type": "HasDataConnectors"
+ }
+ ],
+ "availability": {
+ "isPreview": false
+ },
+ "permissions": {
+ "resourceProvider": [
+ {
+ "provider": "Microsoft.OperationalInsights/workspaces",
+ "permissionsDisplayText": "Read and write permissions are required to ingest data into the Log Analytics workspace.",
+ "providerDisplayName": "Workspace",
+ "scope": "Workspace",
+ "requiredPermissions": {
+ "read": true,
+ "write": true,
+ "delete": true
+ }
+ }
+ ],
+ "customs": [
+ {
+ "name": "Domain Tools API Key is Required",
+ "description": "To access DomainTools Real Time Feed APIs We need the DomainTools API Key "
+ }
+ ]
+ },
+ "instructionSteps": [
+ {
+ "description": "Enter your DomainTools API key.",
+ "instructions": [
+ {
+ "type": "Textbox",
+ "parameters": {
+ "label": "API Key",
+ "name": "apiKey",
+ "type": "password",
+ "placeholder": "Enter your DomainTools API Key",
+ "validations": {
+ "required": true
+ }
+ }
+ },
+ {
+ "type": "ConnectionToggleButton",
+ "parameters": {
+ "connectLabel": "connect",
+ "name": "toggle"
+ }
+ }
+ ],
+ "title": "Configure DomainTools API"
+ }
+ ]
+ }
+ }
+ },
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]",
+ "apiVersion": "2022-01-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "properties": {
+ "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]",
+ "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]",
+ "kind": "DataConnector",
+ "version": "[variables('dataConnectorCCPVersion')]",
+ "source": {
+ "sourceId": "[variables('_solutionId')]",
+ "name": "[variables('_solutionName')]",
+ "kind": "Solution"
+ },
+ "author": {
+ "name": "DomainTools",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "tier": "Partner",
+ "name": "DomainTools",
+ "email": "memberservices@domaintools.com",
+ "link": "https://www.domaintools.com/support/"
+ },
+ "dependencies": {
+ "criteria": [
+ {
+ "version": "[variables('dataConnectorCCPVersion')]",
+ "contentId": "[variables('_dataConnectorContentIdConnections1')]",
+ "kind": "ResourcesDataConnector"
+ }
+ ]
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections1'), variables('dataConnectorCCPVersion'))]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "contentId": "[variables('_dataConnectorContentIdConnections1')]",
+ "displayName": "DomainTools Threat Intelligence Domain Feed",
+ "contentKind": "ResourcesDataConnector",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('dataConnectorCCPVersion')]",
+ "parameters": {
+ "guidValue": {
+ "defaultValue": "[[newGuid()]",
+ "type": "securestring"
+ },
+ "innerWorkspace": {
+ "defaultValue": "[parameters('workspace')]",
+ "type": "securestring"
+ },
+ "connectorDefinitionName": {
+ "defaultValue": "DomainTools Threat Intelligence Domain Feed",
+ "type": "securestring",
+ "minLength": 1
+ },
+ "workspace": {
+ "defaultValue": "[parameters('workspace')]",
+ "type": "securestring"
+ },
+ "dcrConfig": {
+ "defaultValue": {
+ "dataCollectionEndpoint": "data collection Endpoint",
+ "dataCollectionRuleImmutableId": "data collection rule immutableId"
+ },
+ "type": "object"
+ },
+ "apiKey": {
+ "defaultValue": "apiKey",
+ "type": "securestring",
+ "minLength": 1
+ }
+ },
+ "variables": {
+ "_dataConnectorContentIdConnections1": "[variables('_dataConnectorContentIdConnections1')]"
+ },
+ "resources": [
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections1')))]",
+ "apiVersion": "2022-01-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "properties": {
+ "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections1'))]",
+ "contentId": "[variables('_dataConnectorContentIdConnections1')]",
+ "kind": "ResourcesDataConnector",
+ "version": "[variables('dataConnectorCCPVersion')]",
+ "source": {
+ "sourceId": "[variables('_solutionId')]",
+ "name": "[variables('_solutionName')]",
+ "kind": "Solution"
+ },
+ "author": {
+ "name": "DomainTools",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "tier": "Partner",
+ "name": "DomainTools",
+ "email": "memberservices@domaintools.com",
+ "link": "https://www.domaintools.com/support/"
+ }
+ }
+ },
+ {
+ "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'DomainToolsThreatIntelConnectorNOD', parameters('guidValue'))]",
+ "apiVersion": "2023-02-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
+ "location": "[parameters('workspace-location')]",
+ "kind": "RestApiPoller",
+ "properties": {
+ "connectorDefinitionName": "DomainToolsCCFDefinition",
+ "dcrConfig": {
+ "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]",
+ "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]",
+ "streamName": "Custom-DomainToolsThreatIntel_NOD_CL"
+ },
+ "dataType": "DomainToolsThreatIntelDomains_CL",
+ "auth": {
+ "type": "APIKey",
+ "ApiKeyName": "X-Api-Key",
+ "ApiKey": "[[parameters('apiKey')]"
+ },
+ "request": {
+ "apiEndpoint": "https://api.domaintools.com/v1/feed/nod/",
+ "rateLimitQPS": 10,
+ "queryWindowInMin": 10,
+ "httpMethod": "GET",
+ "queryParameters": {
+ "after": "-10"
+ },
+ "headers": {
+ "Accept": "application/json"
+ },
+ "retryCount": 3,
+ "timeoutInSeconds": 60
+ },
+ "response": {
+ "eventsJsonPaths": [
+ "$"
+ ],
+ "format": "json"
+ },
+ "isActive": true
+ }
+ },
+ {
+ "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'DomainToolsThreatIntelConnectorNAD', parameters('guidValue'))]",
+ "apiVersion": "2023-02-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
+ "location": "[parameters('workspace-location')]",
+ "kind": "RestApiPoller",
+ "properties": {
+ "connectorDefinitionName": "DomainToolsCCFDefinition",
+ "dcrConfig": {
+ "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]",
+ "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]",
+ "streamName": "Custom-DomainToolsThreatIntel_NAD_CL"
+ },
+ "dataType": "DomainToolsThreatIntelDomains_CL",
+ "auth": {
+ "type": "APIKey",
+ "ApiKeyName": "X-Api-Key",
+ "ApiKey": "[[parameters('apiKey')]"
+ },
+ "request": {
+ "apiEndpoint": "https://api.domaintools.com/v1/feed/nad/",
+ "rateLimitQPS": 10,
+ "queryWindowInMin": 10,
+ "httpMethod": "GET",
+ "queryParameters": {
+ "after": "-10"
+ },
+ "headers": {
+ "Accept": "application/json"
+ },
+ "retryCount": 3,
+ "timeoutInSeconds": 60
+ },
+ "response": {
+ "eventsJsonPaths": [
+ "$"
+ ],
+ "format": "json"
+ },
+ "isActive": true
+ }
+ },
+ {
+ "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'DomainToolsThreatIntelConnectorNOH', parameters('guidValue'))]",
+ "apiVersion": "2023-02-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
+ "location": "[parameters('workspace-location')]",
+ "kind": "RestApiPoller",
+ "properties": {
+ "connectorDefinitionName": "DomainToolsCCFDefinition",
+ "dcrConfig": {
+ "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]",
+ "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]",
+ "streamName": "Custom-DomainToolsThreatIntel_NOH_CL"
+ },
+ "dataType": "DomainToolsThreatIntelDomains_CL",
+ "auth": {
+ "type": "APIKey",
+ "ApiKeyName": "X-Api-Key",
+ "ApiKey": "[[parameters('apiKey')]"
+ },
+ "request": {
+ "apiEndpoint": "https://api.domaintools.com/v1/feed/noh/",
+ "rateLimitQPS": 10,
+ "queryWindowInMin": 10,
+ "httpMethod": "GET",
+ "queryParameters": {
+ "after": "-10"
+ },
+ "headers": {
+ "Accept": "application/json"
+ },
+ "retryCount": 3,
+ "timeoutInSeconds": 60
+ },
+ "response": {
+ "eventsJsonPaths": [
+ "$"
+ ],
+ "format": "json"
+ },
+ "isActive": true
+ }
+ },
+ {
+ "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'DomainToolsThreatIntelConnectorDD', parameters('guidValue'))]",
+ "apiVersion": "2023-02-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
+ "location": "[parameters('workspace-location')]",
+ "kind": "RestApiPoller",
+ "properties": {
+ "connectorDefinitionName": "DomainToolsCCFDefinition",
+ "dcrConfig": {
+ "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]",
+ "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]",
+ "streamName": "Custom-DomainToolsThreatIntel_DD_CL"
+ },
+ "dataType": "DomainToolsThreatIntelDomains_CL",
+ "auth": {
+ "type": "APIKey",
+ "ApiKeyName": "X-Api-Key",
+ "ApiKey": "[[parameters('apiKey')]"
+ },
+ "request": {
+ "apiEndpoint": "https://api.domaintools.com/v1/feed/domaindiscovery/",
+ "rateLimitQPS": 10,
+ "queryWindowInMin": 10,
+ "httpMethod": "GET",
+ "queryParameters": {
+ "after": "-10"
+ },
+ "headers": {
+ "Accept": "application/json"
+ },
+ "retryCount": 3,
+ "timeoutInSeconds": 60
+ },
+ "response": {
+ "eventsJsonPaths": [
+ "$"
+ ],
+ "format": "json"
+ },
+ "isActive": true
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections1'),'-', variables('dataConnectorCCPVersion'))))]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "version": "[variables('dataConnectorCCPVersion')]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('parserObject1').parserTemplateSpecName1]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "DomainToolsThreatIntelDomains Data Parser with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('parserObject1').parserVersion1]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "name": "[variables('parserObject1')._parserName1]",
+ "apiVersion": "2025-07-01",
+ "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+ "location": "[parameters('workspace-location')]",
+ "eTag": "*",
+ "properties": {
+ "eTag": "*",
+ "displayName": "DomainTools Threat Intel Domain Parser",
+ "category": "Microsoft Sentinel Parser",
+ "functionAlias": "DomainToolsThreatIntelDomains",
+ "query": "let _lookback = coalesce(lookback, 1d);\nlet _domain_type = coalesce(domain_type, \"\");\nDomainToolsThreatIntelDomains_CL\n| where TimeGenerated >= ago(_lookback)\n| where domaintype == _domain_type\n| project\n TimeGenerated,\n timestamp,\n domain,\n domaintype\n| extend\n DomainCustomEntity = domain\n",
+ "functionParameters": "lookback:timespan=1d,domain_type:string",
+ "version": 2,
+ "tags": [
+ {
+ "name": "description",
+ "value": ""
+ }
+ ]
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]",
+ "dependsOn": [
+ "[variables('parserObject1')._parserId1]"
+ ],
+ "properties": {
+ "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'DomainToolsThreatIntelDomains')]",
+ "contentId": "[variables('parserObject1').parserContentId1]",
+ "kind": "Parser",
+ "version": "[variables('parserObject1').parserVersion1]",
+ "source": {
+ "name": "DomainTools CCF",
+ "kind": "Solution",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "DomainTools",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "tier": "Partner",
+ "name": "DomainTools",
+ "email": "memberservices@domaintools.com",
+ "link": "https://www.domaintools.com/support/"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('parserObject1').parserContentId1]",
+ "contentKind": "Parser",
+ "displayName": "DomainTools Threat Intel Domain Parser",
+ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]",
+ "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]",
+ "version": "[variables('parserObject1').parserVersion1]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+ "apiVersion": "2025-07-01",
+ "name": "[variables('parserObject1')._parserName1]",
+ "location": "[parameters('workspace-location')]",
+ "eTag": "*",
+ "properties": {
+ "eTag": "*",
+ "displayName": "DomainTools Threat Intel Domain Parser",
+ "category": "Microsoft Sentinel Parser",
+ "functionAlias": "DomainToolsThreatIntelDomains",
+ "query": "let _lookback = coalesce(lookback, 1d);\nlet _domain_type = coalesce(domain_type, \"\");\nDomainToolsThreatIntelDomains_CL\n| where TimeGenerated >= ago(_lookback)\n| where domaintype == _domain_type\n| project\n TimeGenerated,\n timestamp,\n domain,\n domaintype\n| extend\n DomainCustomEntity = domain\n",
+ "functionParameters": "lookback:timespan=1d,domain_type:string",
+ "version": 2,
+ "tags": [
+ {
+ "name": "description",
+ "value": ""
+ }
+ ]
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "location": "[parameters('workspace-location')]",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]",
+ "dependsOn": [
+ "[variables('parserObject1')._parserId1]"
+ ],
+ "properties": {
+ "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'DomainToolsThreatIntelDomains')]",
+ "contentId": "[variables('parserObject1').parserContentId1]",
+ "kind": "Parser",
+ "version": "[variables('parserObject1').parserVersion1]",
+ "source": {
+ "kind": "Solution",
+ "name": "DomainTools CCF",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "DomainTools",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "tier": "Partner",
+ "name": "DomainTools",
+ "email": "memberservices@domaintools.com",
+ "link": "https://www.domaintools.com/support/"
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
+ "apiVersion": "2023-04-01-preview",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "version": "3.0.0",
+ "kind": "Solution",
+ "contentSchemaVersion": "3.0.0",
+ "displayName": "DomainTools CCF",
+ "publisherDisplayName": "DomainTools",
+ "descriptionHtml": "Note: Please refer to the following before installing the solution:
\n• Review the solution Release Notes
\n• There may be known issues pertaining to this Solution, please refer to them before installing.
\nThe Domaintools Threat Intelligence Feeds solution for Microsoft Sentinel contains CCF-based data connector that ingests domain-related threat intelligence from Domain tools including Newly Observed Domains (NOD), Newly Observed Hostnames (NOH), Newly Active Domains (NAD), and Domain Discovery. The solution also provides an analytic rule that automatically creates incidents when new domains are ingested, enabling security teams to quickly detect and investigate potentially malicious domains. In addition, a workbook is included to visualize domain activity, ingestion trends, and correlations with security telemetry, helping SOC analysts improve threat detection and response.
\nData Connectors: 1, Parsers: 1, Workbooks: 1, Analytic Rules: 4
\nLearn more about Microsoft Sentinel | Learn more about Solutions
\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "",
+ "contentId": "[variables('_solutionId')]",
+ "parentId": "[variables('_solutionId')]",
+ "source": {
+ "kind": "Solution",
+ "name": "DomainTools CCF",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "DomainTools",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "DomainTools",
+ "email": "memberservices@domaintools.com",
+ "tier": "Partner",
+ "link": "https://www.domaintools.com/support/"
+ },
+ "dependencies": {
+ "operator": "AND",
+ "criteria": [
+ {
+ "kind": "AnalyticsRule",
+ "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+ "version": "[variables('analyticRuleObject1').analyticRuleVersion1]"
+ },
+ {
+ "kind": "AnalyticsRule",
+ "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
+ "version": "[variables('analyticRuleObject2').analyticRuleVersion2]"
+ },
+ {
+ "kind": "AnalyticsRule",
+ "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
+ "version": "[variables('analyticRuleObject3').analyticRuleVersion3]"
+ },
+ {
+ "kind": "AnalyticsRule",
+ "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
+ "version": "[variables('analyticRuleObject4').analyticRuleVersion4]"
+ },
+ {
+ "kind": "Workbook",
+ "contentId": "[variables('_workbookContentId1')]",
+ "version": "[variables('workbookVersion1')]"
+ },
+ {
+ "kind": "DataConnector",
+ "contentId": "[variables('_dataConnectorContentIdConnections1')]",
+ "version": "[variables('dataConnectorCCPVersion')]"
+ },
+ {
+ "kind": "Parser",
+ "contentId": "[variables('parserObject1').parserContentId1]",
+ "version": "[variables('parserObject1').parserVersion1]"
+ }
+ ]
+ },
+ "firstPublishDate": "2025-11-30",
+ "providers": [
+ "DomainTools"
+ ],
+ "categories": {
+ "domains": [
+ "Security - Threat Intelligence"
+ ]
+ }
+ },
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]"
+ }
+ ],
+ "outputs": {}
+}
diff --git a/Solutions/DomainTools CCF/Package/testParameters.json b/Solutions/DomainTools CCF/Package/testParameters.json
new file mode 100644
index 00000000000..4d8c5e0a47c
--- /dev/null
+++ b/Solutions/DomainTools CCF/Package/testParameters.json
@@ -0,0 +1,46 @@
+{
+ "location": {
+ "type": "string",
+ "minLength": 1,
+ "defaultValue": "[resourceGroup().location]",
+ "metadata": {
+ "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace"
+ }
+ },
+ "workspace-location": {
+ "type": "string",
+ "defaultValue": "",
+ "metadata": {
+ "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"
+ }
+ },
+ "workspace": {
+ "defaultValue": "",
+ "type": "string",
+ "metadata": {
+ "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
+ }
+ },
+ "workbook1-name": {
+ "type": "string",
+ "defaultValue": "DomainTools Threat Intelligence CCF Dashboards",
+ "minLength": 1,
+ "metadata": {
+ "description": "Name for the workbook"
+ }
+ },
+ "resourceGroupName": {
+ "type": "string",
+ "defaultValue": "[resourceGroup().name]",
+ "metadata": {
+ "description": "resource group name where Microsoft Sentinel is setup"
+ }
+ },
+ "subscription": {
+ "type": "string",
+ "defaultValue": "[last(split(subscription().id, '/'))]",
+ "metadata": {
+ "description": "subscription id where Microsoft Sentinel is setup"
+ }
+ }
+}
diff --git a/Solutions/DomainTools CCF/Parsers/DomainToolsThreatIntelDomains.yaml b/Solutions/DomainTools CCF/Parsers/DomainToolsThreatIntelDomains.yaml
new file mode 100644
index 00000000000..6a8cd4d3836
--- /dev/null
+++ b/Solutions/DomainTools CCF/Parsers/DomainToolsThreatIntelDomains.yaml
@@ -0,0 +1,27 @@
+id: 6c9b6b9e-3d6b-4c5e-9f61-1c0b7f7a9e21
+Function:
+ Title: DomainTools Threat Intel Domain Parser
+ Version: '1.0.0'
+ LastUpdated: '2026-01-19'
+Category: Microsoft Sentinel Parser
+FunctionName: DomainToolsThreatIntelDomains
+FunctionAlias: DomainToolsThreatIntelDomains
+FunctionParams:
+ - Name: lookback
+ Type: timespan
+ Default: 1d
+ - Name: domain_type
+ Type: string
+FunctionQuery: |
+ let _lookback = coalesce(lookback, 1d);
+ let _domain_type = coalesce(domain_type, "");
+ DomainToolsThreatIntelDomains_CL
+ | where TimeGenerated >= ago(_lookback)
+ | where domaintype == _domain_type
+ | project
+ TimeGenerated,
+ timestamp,
+ domain,
+ domaintype
+ | extend
+ DomainCustomEntity = domain
diff --git a/Solutions/DomainTools CCF/ReleaseNotes.md b/Solutions/DomainTools CCF/ReleaseNotes.md
new file mode 100644
index 00000000000..2d9ef4896b7
--- /dev/null
+++ b/Solutions/DomainTools CCF/ReleaseNotes.md
@@ -0,0 +1,4 @@
+| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
+|-------------|--------------------------------|--------------------|
+| 3.0.0 | 10-11-2025 | Includes all CCF connector definitions and configurations. |
+
diff --git a/Solutions/DomainTools CCF/SolutionMetadata.json b/Solutions/DomainTools CCF/SolutionMetadata.json
new file mode 100644
index 00000000000..0fe4294df82
--- /dev/null
+++ b/Solutions/DomainTools CCF/SolutionMetadata.json
@@ -0,0 +1,15 @@
+{
+ "publisherId": "domaintoolsccf",
+ "offerId": "azure-sentinel-solution-domaintools-threatintel",
+ "firstPublishDate": "2025-11-30",
+ "providers": [ "DomainTools" ],
+ "categories": {
+ "domains": ["Security - Threat Intelligence" ]
+ },
+ "support": {
+ "tier": "Partner",
+ "name": "DomainTools",
+ "email": "memberservices@domaintools.com",
+ "link": "https://www.domaintools.com/support/"
+ }
+}
\ No newline at end of file
diff --git a/Solutions/DomainTools CCF/Workbooks/DomainTools_workbook.json b/Solutions/DomainTools CCF/Workbooks/DomainTools_workbook.json
new file mode 100644
index 00000000000..c1a9a9f2fda
--- /dev/null
+++ b/Solutions/DomainTools CCF/Workbooks/DomainTools_workbook.json
@@ -0,0 +1,77 @@
+{
+ "version": "Notebook/1.0",
+ "items": [
+ {
+ "type": 1,
+ "content": {
+ "json": "# DomainTools Threat Intelligence Dashboard\nVisualize and correlate DomainTools threat domain data.\n---\n\nThis workbook provides insights into domains flagged by DomainTools, their ingestion frequency, domain types."
+ },
+ "name": "Header"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "DomainToolsThreatIntelDomains_CL\n| where TimeGenerated > ago(12h)\n| summarize Count = count() by bin(TimeGenerated, 1h), domaintype\n| order by TimeGenerated asc\n| render barchart",
+ "size": 0,
+ "title": "Domains in Last 12 Hours",
+ "timeContext": {
+ "durationMs": 172800000
+ },
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "barchart"
+ },
+ "name": "Last12HourDomains"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "DomainToolsThreatIntelDomains_CL\n| summarize Count = count() by domaintype\n| render piechart",
+ "size": 3,
+ "title": "Domain Count by Type",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ },
+ "customWidth": "50",
+ "name": "DomainTypePie",
+ "styleSettings": {
+ "maxWidth": "50%"
+ }
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "DomainToolsThreatIntelDomains_CL\n| summarize TotalDomains = count(), LatestIngestion = max(TimeGenerated)",
+ "size": 4,
+ "title": "Overview: Ingested Domains Summary",
+ "timeContext": {
+ "durationMs": 2592000000
+ },
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "gridSettings": {
+ "labelSettings": [
+ {
+ "columnId": "TotalDomains",
+ "label": "Total Domains Ingested"
+ },
+ {
+ "columnId": "LatestIngestion",
+ "label": "Recent Ingestion Date & Time"
+ }
+ ]
+ }
+ },
+ "customWidth": "50",
+ "name": "Summary",
+ "styleSettings": {
+ "maxWidth": "50%"
+ }
+ }
+ ],
+ "fromTemplateId": "sentinel-Workbook",
+ "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
+}
\ No newline at end of file
diff --git a/Workbooks/Images/Logos/DomainTools.svg b/Workbooks/Images/Logos/DomainTools.svg
new file mode 100644
index 00000000000..eeb9334af39
--- /dev/null
+++ b/Workbooks/Images/Logos/DomainTools.svg
@@ -0,0 +1 @@
+
diff --git a/Workbooks/Images/Preview/DomainToolsCCFWorkbookBlack.png b/Workbooks/Images/Preview/DomainToolsCCFWorkbookBlack.png
new file mode 100644
index 00000000000..093a653b590
Binary files /dev/null and b/Workbooks/Images/Preview/DomainToolsCCFWorkbookBlack.png differ
diff --git a/Workbooks/Images/Preview/DomainToolsCCFWorkbookWhite.png b/Workbooks/Images/Preview/DomainToolsCCFWorkbookWhite.png
new file mode 100644
index 00000000000..286c62f6312
Binary files /dev/null and b/Workbooks/Images/Preview/DomainToolsCCFWorkbookWhite.png differ
diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json
index 8f98453d009..6715442bea3 100644
--- a/Workbooks/WorkbooksMetadata.json
+++ b/Workbooks/WorkbooksMetadata.json
@@ -11031,5 +11031,25 @@
"templateRelativePath": "PRODAFTUstaATPOverview.json",
"subtitle": "",
"provider": "PRODAFT"
- }
+ },
+ {
+ "workbookKey": "DomainToolCCFWorkbook",
+ "logoFileName": "DomainTools.svg",
+ "description": "# DomainTools CCF workbook provides insights into domains flagged by DomainTools, their ingestion frequency, domain types.",
+ "dataTypesDependencies": [
+ "DomainToolsThreatIntelDomains_CL"
+ ],
+ "dataConnectorsDependencies": [
+ "DomainToolsCCFDefinition"
+ ],
+ "previewImagesFileNames": [
+ "DomainToolsCCFWorkbookWhite.png",
+ "DomainToolsCCFWorkbookBlack.png"
+ ],
+ "version": "1.0",
+ "title": "DomainTools Threat Intelligence CCF Dashboards",
+ "templateRelativePath": "DomainTools_workbook.json",
+ "subtitle": "",
+ "provider": "DomainTools"
+ }
]