Overview

Iris is powered by numerous data sources and allows customers to turn threat intelligence into actionable insights. Access to domain and DNS data at scale arms security analysts with critical knowledge throughout their investigations. Investigations powered by DomainTools not only allow organizations to assess whether or not an indicator identified on a network is malicious, but to identify connected malicious infrastructure and prevent future attacks.

These types of forensic investigations are only as good as the volume and quality of threat intelligence data. Because of the breadth and depth of our data, we are able to help investigators identify relationships between domains like common registrant owners, shared infrastructure, and common communications. Peter Allwright of Horizon Forensics and his organization have experienced this value first-hand: “Iris was an absolutely critical resource in this particular investigation and we are confident that it will be at the center of many future projects. DomainTools didn’t just help us generate more frequent leads for our team, it enabled us to quickly pivot on the different data points so we could elevate the most relevant pieces of evidence and provide a much clearer overall picture.”

One top level goal in terms of delivering value to our customers is to empower security professionals to get ahead of attacks. A CISO at a large Metropolitan Government Agency highlights DomainTools role in predicting threats before any damage is done: “DomainTools not only provides our team with better overall threat intelligence but it has also empowered our team to more accurately assess and score the risk represented by coordinated threat actors. As a result, our small team is even more agile and responsive to the many agencies and constituents that we serve on a daily basis.”