[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-02。"],[[["\u003cp\u003eGoogle Security Operations allows investigation of domains to identify their presence and impact within an enterprise.\u003c/p\u003e\n"],["\u003cp\u003eThe Domain view provides context about a queried domain, including log data references and external enrichments from sources like VirusTotal, along with WHOIS information.\u003c/p\u003e\n"],["\u003cp\u003eA Prevalence graph in the Domain view shows the historical access of a domain, indicating potential threats based on how frequently assets connect to it.\u003c/p\u003e\n"],["\u003cp\u003eDomain insights offer additional context, checking against threat intelligence lists from sources such as ET Intelligence and ESET, and displaying information like resolved IPs, associated subdomains, and sibling domains.\u003c/p\u003e\n"],["\u003cp\u003eThe Timeline tab lists up to 1000 events related to the domain, but the view has limitations such as only showing DNS, EDR, and Webproxy event types, and not showing generic events.\u003c/p\u003e\n"]]],[],null,["# Investigate a domain\n====================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nGoogle Security Operations lets you to investigate specific domains to determine if\nany are present within your enterprise, and what impact these outside systems\nmight have had on your assets.\n\nTo access **Domain** view in Google SecOps, complete the following steps:\n\n1. Enter the domain (ending with a known public suffix) or URL in the search\n bar on the Google SecOps landing page.\n\n | **Note:** The public suffix data list from publicsuffix.org includes both public and private domains as public suffixes. However, this function doesn't treat a private domain as a public suffix. For example, if us.com is listed as a private domain, calling the function with foo.us.com returns us.com---interpreted as the public suffix com plus the preceding label us---instead of foo.us.com (which would treat us.com as a private domain).\n2. Click **Search** . If the domain is present in your enterprise, it is listed\n under the **Domains** heading. Click the domain name link to pivot to\n **Domain** view. If the domain is present within your enterprise, additional\n information is displayed in **Domain** view. If the domain is not present,\n **Domain** view will be empty.\n\n | **Note:** [UDM search](/chronicle/docs/investigation/udm-search) provides enhanced capabilities that let you conduct more thorough investigations of the events and alerts within your Google SecOps instance than is possible using **Domain** view alone. For more information, see [UDM search](/chronicle/docs/investigation/udm-search).\n\nDomain context\n--------------\n\nDomain view displays context about the queried domain, to include references in\ningested log data as well as third-party and external enrichments from sources like\nVirusTotal.\n\n#### VT Context\n\nClick **VT Context** to view the VirusTotal information available for this\ndomain.\n\n#### WHOIS\n\nGoogle SecOps displays the\n[WHOIS](https://whois.icann.org/en/about-whois)\ninformation associated with the registered domain. This information can be\nuseful when assessing a domain's reputation.\n\n#### Prevalence\n\nGoogle SecOps provides a graphical representation of the historical\nprevalence of a given FQDN and its TLD. This graph can be used to determine\nwhether the domain has been accessed from within the enterprise before, and can\nprovide an indication of whether the domain is associated with a particular\ncampaign targeting the enterprise. Typically, less prevalent domains, ones that\nfewer assets have connected to, might represent a greater threat to your\nenterprise.\n\nWhen you hold the pointer over a bar in the **Prevalence** graph, the graph\nlists the assets that accessed the domain. Due to the high prevalence of DNS\nservers, they aren't listed. If all of the assets are DNS servers, no assets are\nlisted.\n\n#### Domain insights\n\nDomain insights provide you with more context about domains under investigation.\nYou can use them to determine whether a domain is benign or malicious. They also\nlet you further investigate an indicator to determine if there is a broader\ncompromise.\n\nThe domain insights displayed vary depending on the availability of information\nassociated with the domain within your Google SecOps account, but might\ninclude the following:\n\n- **ET Intelligence Rep List:** Checks against ProofPoint's Emerging Threats\n (ET) Intelligence Rep List and lists known threats tied to specific IP\n addresses and domains.\n\n- **[ESET Threat Intelligence](https://www.eset.com/us/):**\n Checks against ESET's threat intelligence service.\n\n- **Resolved IPs:** All resolved IP addresses that have been seen in your\n organization for a given Fully Qualified Domain Name. For example:\n\n - Search for test.altostrat.com (Fully Qualified Domain Name)\n - 2 resolved IPs (198.51.100.81 and 203.0.113.81) are displayed\n- **Associated subdomains:** All associated subdomains that have been seen in\n your organization for a given Fully Qualified Domain Name. Many adversaries\n use the same domain and subdomain for their attacks. For example:\n\n - Search for sandbox.altostrat.com (Fully Qualified Domain Name)\n - 2 subdomains (test.sandbox.altostrat.com and staging.sandbox.altostrat.com) are displayed\n- **Sibling Domains:** All sibling domains that have been seen in your\n organization for a given Fully Qualified Domain Name at a given level. For\n example:\n\n - Search for sandbox.altostrat.com\n - 1 sibling domain (foo.altostrat.com) is displayed\n\nTimeline\n--------\n\nThe **Timeline** tab lists all of the events for the domain. The **Asset identifier** column shows the asset ID. In a small number of cases, Google SecOps replaces the asset ID with the IP address of the asset.\n\nConsiderations\n--------------\n\nDomain view has the following limitations:\n\n- Only 1000 events can be displayed in this view.\n- You can only filter events that are displayed in this view.\n- Only DNS, EDR, and Webproxy event types are populated in this view. The first seen and last seen information populated in this view is also limited to these event types.\n- Generic events don't appear in any of the curated views. They appear only in raw log and UDM searches.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
