Domaintools CCF

.script/tests/KqlvalidationsTests/CustomFunctions/DomainToolsThreatIntelDomains.json

@@ -0,0 +1,35 @@
+{
+  "FunctionName": "DomainToolsThreatIntelDomains",
+  "FunctionParameters": [
+    {
+      "Name": "lookback",
+      "Type": "timespan"
+    },
+    {
+      "Name": "domain_type",
+      "Type": "string"
+    }
+  ],
+  "FunctionResultColumns": [
+    {
+      "Name": "TimeGenerated",
+      "Type": "DateTime"
+    },
+    {
+      "Name": "timestamp",
+      "Type": "String"
+    },
+    {
+      "Name": "domain",
+      "Type": "String"
+    },
+    {
+      "Name": "domaintype",
+      "Type": "String"
+    },
+    {
+      "Name": "DomainCustomEntity",
+      "Type": "String"
+    }
+  ]
+}

.script/tests/KqlvalidationsTests/CustomTables/DomainToolsThreatIntelDomains_CL.json

@@ -0,0 +1,21 @@
+{
+    "Name": "DomainToolsThreatIntelDomains_CL",
+    "Properties": [
+        {
+            "Name": "TimeGenerated",
+            "Type": "DateTime"
+        },
+        {
+            "Name": "timestamp",
+            "Type": "String"
+        },
+        {
+            "Name": "domain",
+            "Type": "String"
+        },
+        {
+            "Name": "domaintype",
+            "Type": "String"
+        }
+    ]
+}

.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json

@@ -84,6 +84,7 @@
   "DatawizaDapSolution",
   "DigitalGuardianDLP",
   "DigitalShadows",
+  "DomainTools",
   "DragosSitestoreCCP",
   "Dynamics365",
   "Dynamics365Finance",

Solutions/DomainTools CCF/Analytic Rules/DomainTools_DomainDiscovery-DD.yaml

@@ -0,0 +1,24 @@
+id: f8c223c1-1a28-4b28-8e9f-5e33b610916b
+name: DomainTools New Domain Discovery Indicators Ingested
+description: Creates an incident whenever DomainTools Domain Discovery new indicators (domains) are ingested in the last 1 hour.
+kind: Scheduled
+severity: Medium
+requiredDataConnectors:
+  - connectorId: DomainTools
+    dataTypes:
+      - DomainToolsThreatIntelDomains_CL
+queryFrequency: 1h
+queryPeriod: 1h
+triggerOperator: gt
+triggerThreshold: 0
+tactics: []
+relevantTechniques: []
+query: "DomainToolsThreatIntelDomains(1h,\"domaindiscovery\")"
+entityMappings:
+  - entityType: DNS
+    fieldMappings:
+      - identifier: DomainName
+        columnName: DomainCustomEntity
+eventGroupingSettings:
+  aggregationKind: SingleAlert
+version: 1.0.0

Solutions/DomainTools CCF/Analytic Rules/DomainTools_NewlyAddedDomains-NAD.yaml

@@ -0,0 +1,24 @@
+id: f8c223c1-1a28-4b28-8e9f-5e34b610916b
+name: DomainTools Newly Added Domains Feeds Ingested
+description: Creates an incident whenever DomainTools Domain Discovery new Feeds (domains) are ingested in the last 1 hour.
+kind: Scheduled
+severity: Medium
+requiredDataConnectors:
+  - connectorId: DomainTools
+    dataTypes:
+      - DomainToolsThreatIntelDomains_CL
+queryFrequency: 1h
+queryPeriod: 1h
+triggerOperator: gt
+triggerThreshold: 0
+tactics: []
+relevantTechniques: []
+query: "DomainToolsThreatIntelDomains(1h,\"nad\")"
+entityMappings:
+  - entityType: DNS
+    fieldMappings:
+      - identifier: DomainName
+        columnName: DomainCustomEntity
+eventGroupingSettings:
+  aggregationKind: SingleAlert
+version: 1.0.0

Solutions/DomainTools CCF/Analytic Rules/DomainTools_NewlyObservedDomains-NOD.yaml

@@ -0,0 +1,24 @@
+id: f8c223c1-1a28-4b28-8e9f-5e35b610916b
+name: DomainTools Newly Observed Domains Feeds Ingested
+description: Creates an incident whenever DomainTools Newly Observed Domains new Feeds (domains) are ingested in the last 1 hour.
+kind: Scheduled
+severity: Medium
+requiredDataConnectors:
+  - connectorId: DomainTools
+    dataTypes:
+      - DomainToolsThreatIntelDomains_CL
+queryFrequency: 1h
+queryPeriod: 1h
+triggerOperator: gt
+triggerThreshold: 0
+tactics: []
+relevantTechniques: []
+query: "DomainToolsThreatIntelDomains(1h, \"nod\")"
+entityMappings:
+  - entityType: DNS
+    fieldMappings:
+      - identifier: DomainName
+        columnName: DomainCustomEntity
+eventGroupingSettings:
+  aggregationKind: SingleAlert
+version: 1.0.0

Solutions/DomainTools CCF/Analytic Rules/DomainTools_NewlyObservedHostnames-NOH.yaml

@@ -0,0 +1,24 @@
+id: f8c223c1-1a28-4b28-8e9f-5e36b610916b
+name: DomainTools Newly Observed Hostnames Feeds Ingested
+description: Creates an incident whenever DomainTools Newly Observed Hostnames new Feeds (domains) are ingested in the last 1 hour.
+kind: Scheduled
+severity: Medium
+requiredDataConnectors:
+  - connectorId: DomainTools
+    dataTypes:
+      - DomainToolsThreatIntelDomains_CL
+queryFrequency: 1h
+queryPeriod: 1h
+triggerOperator: gt
+triggerThreshold: 0
+tactics: []
+relevantTechniques: []
+query: "DomainToolsThreatIntelDomains(1h, \"noh\")"
+entityMappings:
+  - entityType: DNS
+    fieldMappings:
+      - identifier: DomainName
+        columnName: DomainCustomEntity
+eventGroupingSettings:
+  aggregationKind: SingleAlert
+version: 1.0.0

Solutions/DomainTools CCF/Data Connectors/DomainToolsFeedsLogs_ccf/DomainToolsFeedsLogs_DCR.json

@@ -0,0 +1,124 @@
+{
+  "name": "DomainToolsDCR",
+  "apiVersion": "2021-09-01-preview",
+  "type": "Microsoft.Insights/dataCollectionRules",
+  "location": "{{location}}",
+  "dependsOn": [
+    "DomainToolsThreatIntelDomains_CL"
+  ],
+  "kind": null,
+  "properties": {
+    "dataCollectionEndpointId": "{{dataCollectionEndpointId}}",
+    "workspaceResourceId": "{{workspaceResourceId}}",
+    "streamDeclarations": {
+      "Custom-DomainToolsThreatIntel_NOD_CL": {
+        "columns": [
+          {
+            "name": "timestamp",
+            "type": "string",
+            "description": "Timestamp"
+          },
+          {
+            "name": "domain",
+            "type": "string",
+            "description": "Domain"
+          }
+        ]
+      },
+      "Custom-DomainToolsThreatIntel_NOH_CL": {
+        "columns": [
+          {
+            "name": "timestamp",
+            "type": "string",
+            "description": "Timestamp"
+          },
+          {
+            "name": "domain",
+            "type": "string",
+            "description": "Domain"
+          }
+        ]
+      },
+      "Custom-DomainToolsThreatIntel_NAD_CL": {
+        "columns": [
+          {
+            "name": "timestamp",
+            "type": "string",
+            "description": "Timestamp"
+          },
+          {
+            "name": "domain",
+            "type": "string",
+            "description": "Domain"
+          }
+        ]
+      },
+      "Custom-DomainToolsThreatIntel_DD_CL": {
+        "columns": [
+          {
+            "name": "timestamp",
+            "type": "string",
+            "description": "Timestamp"
+          },
+          {
+            "name": "domain",
+            "type": "string",
+            "description": "Domain"
+          }
+        ]
+      }
+    },
+    "dataSources": {},
+    "destinations": {
+      "logAnalytics": [
+        {
+          "name": "dtv2ws1",
+          "workspaceResourceId": "{{workspaceResourceId}}"
+        }
+      ]
+    },
+    "dataFlows": [
+      {
+        "streams": [
+          "Custom-DomainToolsThreatIntel_NOD_CL"
+        ],
+        "destinations": [
+          "dtv2ws1"
+        ],
+        "transformKql": "source \n| extend TimeGenerated = todatetime(timestamp), domaintype = 'nod'\n\n",
+        "outputStream": "Custom-DomainToolsThreatIntelDomains_CL"
+      },
+      {
+        "streams": [
+          "Custom-DomainToolsThreatIntel_NOH_CL"
+        ],
+        "destinations": [
+          "dtv2ws1"
+        ],
+        "transformKql": "source \n| extend TimeGenerated = todatetime(timestamp), domaintype = 'noh'\n\n",
+        "outputStream": "Custom-DomainToolsThreatIntelDomains_CL"
+      },
+      {
+        "streams": [
+          "Custom-DomainToolsThreatIntel_NAD_CL"
+        ],
+        "destinations": [
+          "dtv2ws1"
+        ],
+        "transformKql": "source \n| extend TimeGenerated = todatetime(timestamp), domaintype = 'nad'\n\n",
+        "outputStream": "Custom-DomainToolsThreatIntelDomains_CL"
+      },
+      {
+        "streams": [
+          "Custom-DomainToolsThreatIntel_DD_CL"
+        ],
+        "destinations": [
+          "dtv2ws1"
+        ],
+        "transformKql": "source \n| extend TimeGenerated = todatetime(timestamp), domaintype = 'domaindiscovery'\n\n",
+        "outputStream": "Custom-DomainToolsThreatIntelDomains_CL"
+      }
+    ],
+    "provisioningState": "Succeeded"
+  }
+}