Domain Intelligence Cards® provide an on-demand summary of essential information related to a specific Domain or DNS Names, and are updated in real time as Recorded Future collects new information. You can use Domain Cards as a starting point when assessing whether observation of a given Domain in a specific context is an Indicator of Compromise, and further can be used in security control rules to block or detect incidents. Domain Cards are also pivot points during investigations that start with another indicator, a malware tool, a vulnerability, or a threat actor.
Domain Intelligence Cards include the following tabs:
- Overview
- Risk Rules
- Insikt Group
- Technical Links
- Screenshot
- DNS Resources
- TLS
- WHOIS
- Extensions
- Recent Mentions
Training Available
Use in app-guidance to view the workflow inside of Recorded Future.
Overview
The Intelligence Card Overview includes a Summary of relevant information about this domain as well as modals for Screenshots of the domain, Sandbox Analysis, Recorded Future AI Insights, triggered Risk Rules, and any Analyst Notes written by users in your organization.
- Monitored on/Included in – Shows which of your Watch Lists or threat lists this domain is monitored on or included in. Use the add button to add it to a new list.
- AI Insights – An AI-generated summary of the domain with source attributions
- Sandbox Analysis - Launch a Sandbox analysis report for the domain. Enter a URL or click to pivot directly to the Sandbox.
- Collective Insights – Shows detection counts from your organization's integrated security tools, with a count trend and top contributing integrations. Select Collective Insights Explorer for full detection activity.
- Risk Rules – Shows how many Risk Rules have been triggered for this domain (e.g. "3 out of 10 triggered") and lists them. If none are triggered, the widget shows "No Triggered Risk Rules." Select Risk Rules for the full breakdown.
- References – Shows the Latest published reference to this domain, and — if different — the First published reference. If no first reference has been found yet, a Search for First Reference button lets you look it up on demand. A link to Recent Events is shown when no reference is available.
- Screenshot - Shows a screenshot of the domain, allowing you to quickly examine the content of a newly registered domain of interest.
- Alerts - Alerts on the domain. Click to pivot to alerts for the domain or all alerts.
- Analyst Notes – Where users read and create internal analyst commentary/context tied to this specific domain, separate from Recorded Future's own Insikt Group research.
- Insikt Notes – The single latest Insikt Group note related to this domain written by Recorded Future's own Insikt Group research.
Risk Rules
Clicking on the Risk Rules tab displays Risk History for this domain as well as information on all currently triggered risk rules. Use the drop-down menu in the top right to change the time period for the Risk History view: Last Month, Last 3 Months, and Last Year. Learn more about Domain Risk Rules.
Collective Insight Explorer
This tab displays Recorded Future detections from Splunk, XSOAR, and Sentinel integrations, the Recorded Future for Splunk Demo Environment, and Recorded Future Collective Insights. Navigate to the Collective Insights Explorer for more information.
Insikt Group
View any Insikt Group Notes or Research Links related to the domain.
Technical Links
View any Technical Links related to the domain. These events generally report indicators and technical data observations. You can filter by time to focus only on the most recent events or an extended time frame, and filter by category.
Screenshot
Recorded Future’s Domain Abuse use case now includes a screenshot of the domain, allowing you to quickly examine the content of a newly registered domain of interest and assess the risk it presents to their company.
The most recent domain screenshot can be found in the Overview of the Domain Intelligence Card as well as in the Screenshot tab, as shown below.
DNS Records
View subdomains, DNS Records, and DNS History for the domain.
TLS
View TLS certificates of the company’s domain. Information also includes the issuer, created date and expiration date.
WHOIS
View WHOIS Record Data for the domain. Both current and historical WHOIS records from the organisation’s domain are displayed; click on the timeline to see more details for a specific date.
Extensions
View data from available Intelligence Card Extensions, integrations that enhance Domain Intelligence Cards with content from our Intelligence Partners.