# Incident Investigation and Response URL: https://www.deepinfo.com/solutions/use-cases/incident-investigation-and-response/ ## Investigate Incidents With the Data Underneath. Some incident questions can only be answered from outside your network: what a domain resolved to last month, who registered it, what else they registered, and whether anyone is selling what left. The index behind the Deepinfo Platform answers them. [Request demo](https://www.deepinfo.com/request-demo/) · [Lookup API reference](https://docs.deepinfo.com/reference/lookup/) ### Each Question Has a Source That Answers It. Scope, pivot, timeline, context: investigations come back to these questions. Each row links to the capability that holds the answer. #### [What Did Our Host Look Like Last Week?](https://www.deepinfo.com/platform/easm/continuous-scanning/) Per-asset snapshots of DNS, HTTP, IP DNS (PTR), IP WHOIS, port scans, SSL, web data and WHOIS. #### [What Did This Domain Resolve To?](https://www.deepinfo.com/platform/dsi/instant-lookups/) Passive DNS history: every value, with the times it was observed. #### [Who Registered It, and When Did That Change?](https://www.deepinfo.com/platform/dsi/instant-lookups/) WHOIS history: every distinct registration record, with its dates. #### [What Else Is Connected?](https://www.deepinfo.com/platform/dsi/domain-search/) Reverse lookups, same-time registrations and associated domains. #### [Is It Being Discussed or Sold?](https://www.deepinfo.com/platform/cti/dark-web-search/) Dark web search by email domain, IP, crypto address, card number, CVE and more. #### [Whose Credentials Are Exposed?](https://www.deepinfo.com/platform/cti/data-breach-index/) Breaches that include your addresses, with dates and the data types each one exposed. #### [Which Devices Leaked Them?](https://www.deepinfo.com/platform/cti/compromised-employee-device-monitoring/) Infostealer-infected devices linked to your employees, with password, cookie and token counts. #### [Who Uses This CVE?](https://www.deepinfo.com/platform/cti/threat-actor-intelligence/) The CVEs and tools listed on each threat actor profile. ### From One Domain to Its Neighbors. Three requests, run in order, each answer feeding the next. Request 1 · DNS history ```bash # What has the suspicious domain resolved to? curl "https://api.deepinfo.com/v1/analyze/dns-history?domain=login-acme.example&type=A" \ -H "apikey: YOUR_API_KEY" ``` Response 200 OK · application/json ```json { "fqdn": "login-acme.example", "dn": "login-acme.example", "subdomain": null, "records": [ { "type": "a", "values": [ { "value": "203.0.113.24", "time": ["2026-09-18T05:41:26Z", "2026-09-05T21:26:18Z"] }, { "value": "198.51.100.77", "time": ["2026-08-16T16:37:59Z"] } ] } ] } ``` 2 · Reverse IP: ```bash # Which other domains resolve into the same /24? curl "https://api.deepinfo.com/v1/discovery/reverse-ip?ip=203.0.113.24&mask=24&page_size=25" \ -H "apikey: YOUR_API_KEY" ``` 3 · Same-time: ```bash # What did the same registrant register within 10 minutes? curl "https://api.deepinfo.com/v1/discovery/sametime-domain-finder?domain=login-acme.example&interval=10" \ -H "apikey: YOUR_API_KEY" ``` ### Profiles Inform Attribution Without Deciding It. If the CVE exploited in your incident appears on a Threat Actor Intelligence profile that also targets your sector, the list of candidates gets short. Attribution stays your team’s call. The profiles tell you where to look and what to ask next. - **Identity**: Name, aliases, first and last seen - **Origin**: Countries the actor operates from - **Activity**: Leak sites, forums and markets - **Targets**: Regions, countries, industries, organizations - **Capabilities**: CVEs and tools used ### Keep Watching After It Closes. Verify #### Confirm the Fix An on-demand scan of an affected asset confirms the change without waiting for the next scheduled run. Reopen #### Watch for a Return If a resolved issue’s signal comes back, it reopens as `reappeared`, and a notification rule tells the team. Accounts #### Work the Exposed Logins Credentials tied to the incident move through recorded states until your team closes each one. Report #### Write It Up Export the records behind each finding as CSV or JSON for the incident report. ### Ask the Index Other Questions. - [Threat Hunting](https://www.deepinfo.com/solutions/use-cases/threat-hunting/) (Use case): The index, pointed at a hypothesis instead of an incident. - [Domain Intelligence and Research](https://www.deepinfo.com/solutions/use-cases/domain-intelligence-and-research/) (Use case): All the finders and searches on the domain layer. - [Threat Intelligence Operations](https://www.deepinfo.com/solutions/use-cases/threat-intelligence-operations/) (Use case): Actor profiles and dark web data as daily work. ### Use This Data in Your Tools Analysts can pivot through these records from their own tools: what else sits on an IP address, what a domain resolved to before, and who registered it. - [Reverse IP API](https://www.deepinfo.com/data-api/apis/reverse-ip/) - [DNS History API](https://www.deepinfo.com/data-api/apis/dns-history/) - [WHOIS History API](https://www.deepinfo.com/data-api/apis/whois-history/) - [Reverse WHOIS Email API](https://www.deepinfo.com/data-api/apis/reverse-whois-email/) ### Questions About Incident Investigation and Response **Is this a digital forensics service?** No. The platform supplies the external evidence: what infrastructure looked like, what connects to it and what is said about it. Forensics inside your network stays with your responders or your retained incident response firm. **Can we look up infrastructure that isn’t ours?** Yes. Lookups, history and finders work for any domain or IP address an incident turns up. Port Scan is the exception: it only targets hosts you own or are authorized to test. **Are lookups live or historical?** Both are available. WHOIS, DNS, IP WHOIS and SSL lookups query the target or its registry at request time and stamp the answer with `check_date`, and DNS History and WHOIS History return what the index observed before. **Does history go back before we became a customer?** DNS and WHOIS history come from the index, so they cover whatever the index observed for a domain, independent of your subscription. Per-asset history in your monitoring starts when an asset is added. **Can the pivots be scripted into our playbooks?** Yes. Every lookup and finder is a REST endpoint behind one `apikey` header, with rate limits set by plan. See the [Lookup](https://docs.deepinfo.com/reference/lookup/) and [Discovery](https://docs.deepinfo.com/reference/discovery/) references. ### Run Your Next Investigation on the Index. Bring an indicator from a closed incident to a demo and follow the pivots, histories and actor context with our team. [Request demo](https://www.deepinfo.com/request-demo/)