DomainTools Real-Time Threat Feeds for Microsoft Sentinel

Solution: DomainTools CCF

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Solutions Index

Attribute	Value
Publisher	DomainTools
Support Tier	Partner
Support Link	https://www.domaintools.com/support/
Categories	Security - Threat Intelligence
Version	3.0.0
Author	DomainTools - memberservices@domaintools.com
First Published	2025-11-30
Last Updated	2026-09-04
Solution Folder	DomainTools CCF
Marketplace	Azure Marketplace · Popularity: ⚪ Very Low (0%)

The Domaintools Threat Intelligence Feeds solution for Microsoft Sentinel contains CCF-based data connector that ingests domain-related threat intelligence from Domain tools including Newly Observed Domains (NOD), Newly Observed Hostnames (NOH), Newly Active Domains (NAD), and Domain Discovery. The solution also provides an analytic rule that automatically creates incidents when new domains are ingested, enabling security teams to quickly detect and investigate potentially malicious domains. In addition, a workbook is included to visualize domain activity, ingestion trends, and correlations with security telemetry, helping SOC analysts improve threat detection and response.

Data Connectors
Tables Used
Content Items

Data Connectors

This solution provides 1 data connector(s):

DomainTools Threat Intelligence Domain Feed

Tables Used

This solution uses 1 table(s):

Table	Used By Connectors	Used By Content
`DomainToolsThreatIntelDomains_CL`	DomainTools Threat Intelligence Domain Feed	Analytics, Workbooks

Content Items

This solution includes 6 content item(s):

Content Type	Count
Analytic Rules	4
Workbooks	1
Parsers	1

Analytic Rules

Name	Severity	Tactics	Tables Used
DomainTools New Domain Discovery Indicators Ingested	Medium	-	`DomainToolsThreatIntelDomains_CL`
DomainTools Newly Added Domains Feeds Ingested	Medium	-	`DomainToolsThreatIntelDomains_CL`
DomainTools Newly Observed Domains Feeds Ingested	Medium	-	`DomainToolsThreatIntelDomains_CL`
DomainTools Newly Observed Hostnames Feeds Ingested	Medium	-	`DomainToolsThreatIntelDomains_CL`

Workbooks

Name	Tables Used
DomainTools_workbook	`DomainToolsThreatIntelDomains_CL`

Parsers

Name	Description	Tables Used
DomainToolsThreatIntelDomains	-	`DomainToolsThreatIntelDomains_CL` (read)

Release Notes

Version	Date Modified (DD-MM-YYYY)	Change History
3.0.0	02-09-2026	Includes all CCF connector definitions and configurations. Updated publisherId to address an issue identified during Microsoft Marketplace submission.