Reports and datasets
How Datazag data reaches you. Reports are documents about a domain or an estate. Datasets are tables in your own warehouse, built from 371.9M domains of observation. Alerts reach Microsoft Sentinel as a threat-intelligence feed.
Datazag observes public internet infrastructure: nameservers, mail routing, email-authentication records, addressing and network placement. It does not work from a static list. Reports and datasets are two ways to receive what it sees. Both describe a domain. What you decide about that domain stays your call.
What 371.9M counts: Domains in the Datazag corpus whose latest resolution returned records. Names that no longer exist (NXDOMAIN) and names whose servers failed are excluded. This is the figure the Datazag Observatory publishes as its corpus count. Measured .
Infrastructure
Where a domain lives: its nameserver, hosting address and country, and whether it resolves at all.
Mail and authentication
Whether a domain publishes SPF and DMARC, and whether it runs its own mail or sits on a mailbox provider.
Reports are documents. How each one is delivered is listed below.
| Report | Scope | How it is delivered |
|---|---|---|
| Free exposure snapshot | One domain | Self-serve. Enter a work email on the site; the report is generated in the customer portal and delivered by email. |
| Domain infrastructure report | One domain, in depth | Self-serve. Bought by card in the customer portal; delivered as a document for technical and executive readers. |
| Organization estate report | Portfolio, estate or supplier group | Opens with estate discovery, so the scope is agreed before it runs. |
Building report findings into your own product? Use the datasets below. Report catalog · Sample report
Datasets are SQL tables. They arrive as cloud data shares and marketplace listings for warehouse and lakehouse use: bulk analysis, historical review and enrichment joins.
Typed schema
Every column documented with its type and meaning, and join keys marked.
Worked SQL
Runnable examples per dataset, including the join key conversions.
Stated refresh
Each page states its own cadence and carries a changelog.
Each page documents only what actually ships. Browse the dataset catalog
Datazag alerts reach Microsoft Sentinel as threat-intelligence indicators. Sentinel pulls them from a TAXII 2.1 server, on a schedule you set. Datazag never connects to your workspace.
Format
STIX 2.1 indicator objects. Not OCSF.
Table
ThreatIntelIndicators, Sentinel's own table. No custom table or data collection rule.
Content
The Datazag solution in the Content Hub adds an analytic rule and a hunting query.
Connect the feed
- Install the Datazag solution from the Microsoft Sentinel Content Hub.
- Ask support@datazag.com for TAXII credentials. Name the collections your subscription includes.
- In the Defender portal, open Microsoft Sentinel, then Configuration, then Data connectors. Open Threat Intelligence - TAXII and select Add.
- Enter a friendly name, the API root and one collection ID, with your credentials. Poll once an hour. Repeat for each collection.
- Enable the analytic rule under Manage solution. It matches indicators against DNS activity through the ASIM DNS parsers, so those must be deployed.
| Setting | Value |
|---|---|
| API root | https://taxii.datazag.com/api/ |
| Platform impersonation | c7ad8fef-c704-4b36-9526-5d7c3bd018c4 |
| Attacker infrastructure | eedf8709-5e4f-4ed4-b840-5eaafa236b70 |
| Brand impersonation | Issued per organization, with your credentials |
What an indicator looks like
One indicator per alerted domain or IP address. Sentinel stores the full object in the Data column. The values below are reserved examples.
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--3f1c2a9e-7b4d-5e8f-9a10-2b3c4d5e6f70",
"created_by_ref": "identity--55a5a448-c6f1-5128-bc71-4d85b719131e",
"created": "2026-10-01T08:12:44.000Z",
"modified": "2026-10-01T08:12:44.000Z",
"valid_from": "2026-10-01T08:12:44.000Z",
"valid_until": "2026-10-31T08:12:44.000Z",
"name": "Platform Impersonation: exchange-signin.example",
"pattern": "[domain-name:value = 'exchange-signin.example']",
"pattern_type": "stix",
"indicator_types": ["malicious-activity", "impersonation"],
"confidence": 92,
"labels": ["platform.suspicious_gtld_for_brand", "infra.bulletproof_asn"],
"external_references": [{
"source_name": "datazag",
"external_id": "INC-1782384515-13ec9b"
}]
}| Field | Meaning |
|---|---|
created_by_ref | Always the Datazag identity. Match on this, not SourceSystem, which is the name you give the TAXII server. |
pattern | The domain, or an IP address where the alert says to block it. |
confidence | 0 to 100. The solution's analytic rule fires at 85 and above. |
valid_until | 30 days after the last observation. An indicator expires unless it is seen again. |
labels | The reason codes behind the alert. |
external_references | The Datazag alert ID, and a link to the evidence pack where one exists. |
revoked | Set to true when Datazag withdraws an indicator, for example after de-escalation. |
How fresh is the data?
Certificate Transparency is consumed continuously, so newly issued certificates are observed as they are logged. DNS and hosting records are re-resolved on a rolling schedule; the refresh cadence for each field is documented on the dataset page that ships it.
How do I get data in bulk?
Use the datasets. They are tables in your own warehouse. The datasets section shows where each one is available.