Where this offering fits
IrisQL is DomainTools’ investigation offering for querying domain intelligence. Select it around repeatable analytical questions and the context a reviewer needs to validate a result. Query access should be evaluated separately from the authority to block or report the domains returned.
Architecture and rollout decisions
Use approved sample cases and document expected investigative steps. Confirm supported query functions, datasets and export or integration limits. Preserve the query and relevant time context with results so another analyst can understand the evidence. Include a benign comparison case to examine overbroad associations.
An evaluation scenario for this offering
Define a repeatable IrisQL investigation question with an expected known example and a benign comparison set. Have an analyst build the supported query and retain its parameters, time context and entitlement assumptions. Ask another authorised analyst to rerun the query and explain any difference caused by changed data or filters. Include an intentionally broad query that returns irrelevant associations, then narrow it with a documented rationale. Acceptance should show that the team can reproduce and challenge the investigation. Query results should remain leads for review rather than becoming an unexamined instruction to block all returned domains.
Evidence to request for this scope
- Validate queries against known investigation examples.
- Confirm supported data and usage entitlements.
- Retain reproducible query context with case evidence.