Domaintools CCF

[Rambatla Venkat Rao (RamboV)]

Required items, please complete

Change(s):

Added new DomainTools CCF Connector
Reason for Change(s):

New Domain Tools TI CCF Connector
Version Updated:

None
Testing Completed:

Yes
Checked that the validations are passing and have addressed any issues that are present:

See guidance below

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a new DomainTools CCF Microsoft Sentinel solution package, including a CCF data connector, workbook, parsers, and analytic rules.

Changes:

• Added DomainTools CCF solution metadata, release notes, package ARM templates, and createUiDefinition.
• Added CCF data connector definition + poller/DCR/table artifacts, plus workbook and parser.
• Updated global workbook metadata and test validation assets (valid connector IDs, custom table/function schemas).

Reviewed changes

Copilot reviewed 20 out of 24 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
Workbooks/WorkbooksMetadata.json	Registers the new DomainTools workbook in the shared workbook catalog.
Solutions/DomainTools CCF/Workbooks/DomainTools_workbook.json	Adds the DomainTools Threat Intelligence workbook content and KQL visuals.
Solutions/DomainTools CCF/SolutionMetadata.json	Defines solution publisher, offer, support, and categorization metadata.
Solutions/DomainTools CCF/ReleaseNotes.md	Introduces initial release notes entry for the solution.
Solutions/DomainTools CCF/Parsers/DomainToolsThreatIntelDomains.yaml	Adds a KQL function/parser for DomainTools threat domain data.
Solutions/DomainTools CCF/Package/testParameters.json	Adds test parameters for ARM/TTK validation and workbook naming.
Solutions/DomainTools CCF/Package/mainTemplate.json	Adds the deployable ARM template packaging connector/workbook/rules/parser.
Solutions/DomainTools CCF/Package/createUiDefinition.json	Adds Azure Marketplace/Portal UI definition for solution installation.
Solutions/DomainTools CCF/Data/Solution_DomainTools.json	Adds solution manifest referencing included artifacts (rules, workbook, connector, parser).
Solutions/DomainTools CCF/Data Connectors/DomainToolsFeedsLogs_ccf/DomainToolsFeedsLogs_connectorDefinition.json	Adds the CCF connector definition (UI + permissions + instructions).
Solutions/DomainTools CCF/Data Connectors/DomainToolsFeedsLogs_ccf/DomainToolsFeedsLogs_Table.json	Adds the custom table schema for ingested DomainTools domains.
Solutions/DomainTools CCF/Data Connectors/DomainToolsFeedsLogs_ccf/DomainToolsFeedsLogs_PollerConfig.json	Adds poller configurations for NOD/NAD/NOH/DD feeds.
Solutions/DomainTools CCF/Data Connectors/DomainToolsFeedsLogs_ccf/DomainToolsFeedsLogs_DCR.json	Adds the DCR that maps feed streams into the final custom table.
Solutions/DomainTools CCF/Analytic Rules/DomainTools_NewlyObservedHostnames-NOH.yaml	Adds scheduled analytic rule for NOH feed ingestion.
Solutions/DomainTools CCF/Analytic Rules/DomainTools_NewlyObservedDomains-NOD.yaml	Adds scheduled analytic rule for NOD feed ingestion.
Solutions/DomainTools CCF/Analytic Rules/DomainTools_NewlyAddedDomains-NAD.yaml	Adds scheduled analytic rule for NAD feed ingestion.
Solutions/DomainTools CCF/Analytic Rules/DomainTools_DomainDiscovery-DD.yaml	Adds scheduled analytic rule for Domain Discovery feed ingestion.
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json	Adds DomainTools as a valid connectorId for analytic rule validation.
.script/tests/KqlvalidationsTests/CustomTables/DomainToolsThreatIntelDomains_CL.json	Adds custom table schema for KQL validation tests.
.script/tests/KqlvalidationsTests/CustomFunctions/DomainToolsThreatIntelDomains.json	Adds custom function schema for KQL validation tests.

[v-atulyadav]

Hi Rambatla Venkat Rao (@RamboV),
Please review the suggestions above and implement the necessary changes accordingly.
Additionally, please share screenshots confirming that the connector has been connected successfully, along with the corresponding invocation logs. Thanks

[v-atulyadav]

Hi Rambatla Venkat Rao (@RamboV),
Please review the suggestions above and implement the necessary changes accordingly.

Additionally, please share screenshots confirming that the connector has been connected successfully, along with the corresponding invocation logs for verification. Thanks

[v-atulyadav]

Hi Rambatla Venkat Rao (@RamboV),
Please review the comments above and take the necessary action accordingly. Thanks

[Rambatla Venkat Rao (RamboV)]

Hi v-atulyadav I am working on it will Update you Today.
Thanks

[Rambatla Venkat Rao (RamboV)]

Hi v-atulyadav, Please find the screenshots below. Thanks

[Rambatla Venkat Rao (RamboV)]

Hi v-atulyadav, The error in workbook validation is failing can you please check as its not related to this project.
"""24 files changed in current PR
1 files changed in current PR after filter. File Type Filter: WorkbooksMetadata.json, File path Filter: Workbooks, File Kind Filter: Modified
WorkbooksMetadata Validation Failed. File path: Workbooks/WorkbooksMetadata.json. Error message: Can't locate logo image file MicrosoftADTierModel.svg under the Workbooks/Images/Logos directory"""".

Please let me know what should be our next step.

Thanks

[Rambatla Venkat Rao (RamboV)]

Hi v-atulyadav,
Need you assistance on this issue as the logo not found error is not related to our Solution.
Thanks

[Rambatla Venkat Rao (RamboV)]

Hi v-atulyadav, All checks have passed successfully. Please review and merge.
Thanks