Initial Domaintools Integration

[wesleya]

Initial integration for DomainTools Newly Observed Domains feed.

Please explain:

• WHAT: Initial datastream, ingest pipeline, fields for DomainTools Newly Observed Domains feed.
• WHY: First DomainTools feed integration

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• Newly Observed Domains feed

How to test this PR locally

Install and configure DomainTools integration. Search for feed results: data_stream.dataset: "domaintools.nod_feed"

[cla-checker-service]

💚 CLA has been signed

[wesleya]

Hi @andrewkroh I went ahead and signed the CLA, thank you!

[wesleya]

Hi @andrewkroh apologies if I'm missing something obvious here, first time going through this process. Was there anything else you needed from me to get this PR approved and merged? Thank you for the guidance!

[andrewkroh]

I took quick (non-thorough) look and left a few comments. I'm asking to find the right internal team to help review this.

The integration kind of sounds like it should be treated as a threat intel integration with naming to match (e.g. ti_domaintools). Is that the general use case for this data?

This will need system and pipeline testing.

[andrewkroh]

Can you link to the API docs too. I'm thinking of something like, This data is collected via the [Foo API](https://example.com).

It's important info to have the reference info available for maintaining the integration and troubleshooting. (and for reviewing this PR)

[andrewkroh]

I think this should be converted to the CEL input. We aim to use it for all new development.

Per the http json input docs:

If you are starting development of a new custom HTTP API input, we recommend that you use the Common Expression Language input which provides greater flexibility and an improved developer experience.

[andrewkroh]

What does this timestamp represent? It is the time when the domain was registered? Or first observed through passive DNS means?

[andrewkroh]

Are these going to be eTLDs only or any domain observed anywhere?

[andrewkroh]

This field table and the sample event should be generated from a template that is placed in the _build/ dir (see other integrations as an example).

[wesleya]

Hi @andrewkroh,

Thank you for the review! Your comments make perfect sense. We've just started our company holiday, so we'll be able to address the feedback and submit an update early next year.

Happy holidays to you as well!