Repository: demisto/content
Pull request #39763: FeedDomainTools Release v1.0.3
Author: login: briluza
Labels: name: Contribution
description: Thank you! Contributions are always welcome!
name: docs-approved
name: Partner
name: Contribution Form Filled
description: Whether contribution form filled or not.
name: Partner Support Level
description: Indicates that the contribution is for Partner supported pack
name: External PR
name: Partner-Approved
Created: 2025-04-28T17:51:07Z | Merged: 2025-04-29T13:14:31Z

<!-- REMINDER: THIS IS A PUBLIC REPO DO NOT POST HERE SECRETS/SENSITIVE DATA -->
## Contributing to Cortex XSOAR Content
Make sure to register your contribution by filling the [contribution registration form](https://forms.gle/XDfxU4E61ZwEESSMA)

**The Pull Request will be reviewed only after the contribution registration form is filled.**

## Status
- [ ] In Progress
- [x] Ready
- [ ] In Hold - (Reason for hold)

## Related Issues
N/A

## Description
Implement newly-observed-hostnames(NOH) feeds.

## Screenshots
![image](https://github.com/user-attachments/assets/ce668c17-4ab2-4fc8-8ba6-e0eaa4b2bbfb)
![image](https://github.com/user-attachments/assets/c4c6bdcd-23b9-43f2-a029-052d4174de42)


## Must have
- [x] Tests
- [ ] Documentation 



Diff:
diff --git a/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.py b/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.py
index 5d2b5b9a00f8..b4999f984149 100644
--- a/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.py
+++ b/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.py
@@ -17,10 +17,11 @@ class DomainToolsClient(BaseClient):
 
     APP_PARTNER = "cortex_xsoar_feed"
     APP_NAME = "feed-plugin"
-    APP_VERSION = "1.0.0"
+    APP_VERSION = "1.0.2"
 
     NOD_FEED = "nod"
     NAD_FEED = "nad"
+    NOH_FEED = "noh"
     DOMAINRDAP = "domainrdap"
     DOMAINDISCOVERY = "domaindiscovery"
 
@@ -315,6 +316,7 @@ def fetch_indicators_command(client: DomainToolsClient, params: dict[str, Any] =
     FEEDS_TO_PROCESS = [
         client.NOD_FEED,
         client.NAD_FEED,
+        client.NOH_FEED,
         client.DOMAINRDAP,
         client.DOMAINDISCOVERY
     ]
diff --git a/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.yml b/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.yml
index ca0a3a6dd318..66fe827eee37 100644
--- a/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.yml
+++ b/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.yml
@@ -44,6 +44,7 @@ configuration:
   - ALL
   - nod
   - nad
+  - noh
   - domainrdap
   - domaindiscovery
   additionalinfo: The DomainTools feed type fo fetch. Defaults to 'ALL'.
@@ -152,6 +153,7 @@ script:
       predefined:
       - "nod"
       - "nad"
+      - "noh"
       - "domainrdap"
       - "domaindiscovery"
       defaultValue: "nod"
@@ -212,4 +214,3 @@ marketplaces:
 - platform
 tests:
 - No tests (auto formatted)
-
diff --git a/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools_test.py b/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools_test.py
index 11a8c6a6fdc3..b923c0617d73 100644
--- a/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools_test.py
+++ b/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools_test.py
@@ -119,6 +119,7 @@ def test_conversion_feed_to_indicato_obj(mocker, dt_feeds_client):
     [
         "nod",
         "nad",
+        "noh",
         "domaindiscovery",
         "domainrdap"
     ],
@@ -137,6 +138,7 @@ def test_get_indicators_command(mocker, dt_feeds_client, feed_type):
     mock_feed_response = {
         "nod": feed_mock_response.NOD_FEED_RESPONSE,
         "nad": feed_mock_response.NAD_FEED_RESPONSE,
+        "noh": feed_mock_response.NOH_FEED_RESPONSE,
         "domaindiscovery": feed_mock_response.DOMAINDISCOVERY_RESPONSE,
         "domainrdap": feed_mock_response.DOMAINRDAP_RESPONSE,
     }
@@ -153,6 +155,7 @@ def test_get_indicators_command(mocker, dt_feeds_client, feed_type):
     expected_indicator_results = {
         "nod": feed_mock_response.NOD_PARSED_INDICATOR_RESPONSE,
         "nad": feed_mock_response.NAD_PARSED_INDICATOR_RESPONSE,
+        "noh": feed_mock_response.NOH_PARSED_INDICATOR_RESPONSE,
         "domaindiscovery": feed_mock_response.DOMAINDISCOVERY_PARSED_INDICATOR_RESPONSE,
         "domainrdap": feed_mock_response.DOMAINRDAP_PARSED_INDICATOR_RESPONSE
     }
@@ -190,7 +193,7 @@ def test_fetch_indicators_command(mocker, dt_feeds_client):
     )
     results = fetch_indicators_command(dt_feeds_client, params={"top": "2"})
 
-    assert len(results) == 8
+    assert len(results) == 10
 
 
 def test_calling_command_using_main(mocker, dt_feeds_client):
diff --git a/Packs/FeedDomainTools/Integrations/FeedDomainTools/README.md b/Packs/FeedDomainTools/Integrations/FeedDomainTools/README.md
index cb3b82cd833c..9edae423e793 100644
--- a/Packs/FeedDomainTools/Integrations/FeedDomainTools/README.md
+++ b/Packs/FeedDomainTools/Integrations/FeedDomainTools/README.md
@@ -43,12 +43,12 @@ Gets indicators from the feed.
 
 | **Argument Name** | **Description** | **Required** |
 | --- | --- | --- |
-| feed_type | The DomainTools integration feed type to fetch. Possible values are: nod, nad, domainrdap, domaindiscovery. Default is nod. | Optional | 
-| session_id | The session id to serve as unique indentifier. On it's initial use, it will retrieve data from the past 5 days. Default is dt-cortex-feeds. | Optional | 
-| domain | The top level domain to query (e.g. `*.com`). | Optional | 
-| after | The start of the query window in seconds, relative to the current time, inclusive. Defaults to 3600 seconds (1h). Default is -3600. | Optional | 
-| before | The end of the query window in seconds, relative to the current time, inclusive. | Optional | 
-| top | Limits the number of results in the response payload. Default is 50. | Optional | 
+| feed_type | The DomainTools integration feed type to fetch. Possible values are: nod, nad, noh, domainrdap, domaindiscovery. Default is nod. | Optional |
+| session_id | The session id to serve as unique indentifier. On it's initial use, it will retrieve data from the past 5 days. Default is dt-cortex-feeds. | Optional |
+| domain | The top level domain to query (e.g. `*.com`). | Optional |
+| after | The start of the query window in seconds, relative to the current time, inclusive. Defaults to 3600 seconds (1h). Default is -3600. | Optional |
+| before | The end of the query window in seconds, relative to the current time, inclusive. | Optional |
+| top | Limits the number of results in the response payload. Default is 50. | Optional |
 
 #### Context Output
 
diff --git a/Packs/FeedDomainTools/Integrations/FeedDomainTools/test_data/feed_mock_response.py b/Packs/FeedDomainTools/Integrations/FeedDomainTools/test_data/feed_mock_response.py
index 804de26a046e..8ea9fd71ca8a 100644
--- a/Packs/FeedDomainTools/Integrations/FeedDomainTools/test_data/feed_mock_response.py
+++ b/Packs/FeedDomainTools/Integrations/FeedDomainTools/test_data/feed_mock_response.py
@@ -24,6 +24,19 @@
     '{"timestamp":"2025-01-13T13:37:00Z","domain":"vontresesworldofhair.ws"}',
 ]
 
+NOH_FEED_RESPONSE = [
+    '{"timestamp":"2025-04-23T15:08:43Z","domain":"70-182-75-162_s-104-93-21-49_ts-1745420863-clienttons-s.akamaihd.net"}',
+    '{"timestamp":"2025-04-23T15:08:43Z","domain":"0436e3e5.metrics-bunny.net"}',
+    '{"timestamp":"2025-04-23T15:08:43Z","domain":"mailrelay.salon-gossip.com"}',
+    '{"timestamp":"2025-04-23T15:08:43Z","domain":"jdpf23tilukrq2ajaiya-pzoxrc-94dbdaf6b-clientnsv4-s.akamaihd.net"}',
+    '{"timestamp":"2025-04-23T15:08:43Z","domain":"wdkaurv71m355nb9jupvbr2l.security-notification.co.in"}',
+    '{"timestamp":"2025-04-23T15:08:43Z","domain":"eabqbsyxfgmqakqce3yboaadqnuasart-f-cfbdb0fbf-clienttons-s.akamaihd.net"}',
+    '{"timestamp":"2025-04-23T15:08:43Z","domain":"mk5z4atilukrq2ajajba-pxwook-1e57a800d-clientnsv4-s.akamaihd.net"}',
+    '{"timestamp":"2025-04-23T15:08:43Z","domain":"eabqbua7ausackqce3yloaaaanuasast-f-62424322b-clienttons-s.akamaihd.net"}',
+    '{"timestamp":"2025-04-23T15:08:43Z","domain":"peste.bi.wealthsimple.co"}',
+    '{"timestamp":"2025-04-23T15:08:43Z","domain":"jdagdhdilukte2ajaiya-pqb6kc-b9a8d2c13-clientnsv4-s.akamaihd.net"}',
+]
+
 DOMAINDISCOVERY_RESPONSE = [
     '{"timestamp":"2025-03-07T17:27:11Z","domain":"yashh.xin"}',
     '{"timestamp":"2025-03-07T17:27:11Z","domain":"joinoramaenergy.com"}',
@@ -348,6 +361,159 @@
     },
 ]
 
+NOH_PARSED_INDICATOR_RESPONSE = [
+    {
+        "value": "70-182-75-162_s-104-93-21-49_ts-1745420863-clienttons-s.akamaihd.net",
+        "type": "Domain",
+        "fields": {
+            "tags": "DomainToolsFeeds,noh",
+            "service": "DomainTools Feeds",
+            "firstseenbysource": "2025-04-23T15:08:43Z",
+            "sourcebrands": "FeedDomainTools",
+        },
+        "rawJSON": {
+            "value": "70-182-75-162_s-104-93-21-49_ts-1745420863-clienttons-s.akamaihd.net",
+            "type": "Domain",
+            "timestamp": "2025-04-23T15:08:43Z",
+        },
+    },
+    {
+        "value": "0436e3e5.metrics-bunny.net",
+        "type": "Domain",
+        "fields": {
+            "tags": "DomainToolsFeeds,noh",
+            "service": "DomainTools Feeds",
+            "firstseenbysource": "2025-04-23T15:08:43Z",
+            "sourcebrands": "FeedDomainTools",
+        },
+        "rawJSON": {
+            "value": "0436e3e5.metrics-bunny.net",
+            "type": "Domain",
+            "timestamp": "2025-04-23T15:08:43Z",
+        },
+    },
+    {
+        "value": "mailrelay.salon-gossip.com",
+        "type": "Domain",
+        "fields": {
+            "tags": "DomainToolsFeeds,noh",
+            "service": "DomainTools Feeds",
+            "firstseenbysource": "2025-04-23T15:08:43Z",
+            "sourcebrands": "FeedDomainTools",
+        },
+        "rawJSON": {
+            "value": "mailrelay.salon-gossip.com",
+            "type": "Domain",
+            "timestamp": "2025-04-23T15:08:43Z",
+        },
+    },
+    {
+        "value": "jdpf23tilukrq2ajaiya-pzoxrc-94dbdaf6b-clientnsv4-s.akamaihd.net",
+        "type": "Domain",
+        "fields": {
+            "tags": "DomainToolsFeeds,noh",
+            "service": "DomainTools Feeds",
+            "firstseenbysource": "2025-04-23T15:08:43Z",
+            "sourcebrands": "FeedDomainTools",
+        },
+        "rawJSON": {
+            "value": "jdpf23tilukrq2ajaiya-pzoxrc-94dbdaf6b-clientnsv4-s.akamaihd.net",
+            "type": "Domain",
+            "timestamp": "2025-04-23T15:08:43Z",
+        },
+    },
+    {
+        "value": "wdkaurv71m355nb9jupvbr2l.security-notification.co.in",
+        "type": "Domain",
+        "fields": {
+            "tags": "DomainToolsFeeds,noh",
+            "service": "DomainTools Feeds",
+            "firstseenbysource": "2025-04-23T15:08:43Z",
+            "sourcebrands": "FeedDomainTools",
+        },
+        "rawJSON": {
+            "value": "wdkaurv71m355nb9jupvbr2l.security-notification.co.in",
+            "type": "Domain",
+            "timestamp": "2025-04-23T15:08:43Z",
+        },
+    },
+    {
+        "value": "eabqbsyxfgmqakqce3yboaadqnuasart-f-cfbdb0fbf-clienttons-s.akamaihd.net",
+        "type": "Domain",
+        "fields": {
+            "tags": "DomainToolsFeeds,noh",
+            "service": "DomainTools Feeds",
+            "firstseenbysource": "2025-04-23T15:08:43Z",
+            "sourcebrands": "FeedDomainTools",
+        },
+        "rawJSON": {
+            "value": "eabqbsyxfgmqakqce3yboaadqnuasart-f-cfbdb0fbf-clienttons-s.akamaihd.net",
+            "type": "Domain",
+            "timestamp": "2025-04-23T15:08:43Z",
+        },
+    },
+    {
+        "value": "mk5z4atilukrq2ajajba-pxwook-1e57a800d-clientnsv4-s.akamaihd.net",
+        "type": "Domain",
+        "fields": {
+            "tags": "DomainToolsFeeds,noh",
+            "service": "DomainTools Feeds",
+            "firstseenbysource": "2025-04-23T15:08:43Z",
+            "sourcebrands": "FeedDomainTools",
+        },
+        "rawJSON": {
+            "value": "mk5z4atilukrq2ajajba-pxwook-1e57a800d-clientnsv4-s.akamaihd.net",
+            "type": "Domain",
+            "timestamp": "2025-04-23T15:08:43Z",
+        },
+    },
+    {
+        "value": "eabqbua7ausackqce3yloaaaanuasast-f-62424322b-clienttons-s.akamaihd.net",
+        "type": "Domain",
+        "fields": {
+            "tags": "DomainToolsFeeds,noh",
+            "service": "DomainTools Feeds",
+            "firstseenbysource": "2025-04-23T15:08:43Z",
+            "sourcebrands": "FeedDomainTools",
+        },
+        "rawJSON": {
+            "value": "eabqbua7ausackqce3yloaaaanuasast-f-62424322b-clienttons-s.akamaihd.net",
+            "type": "Domain",
+            "timestamp": "2025-04-23T15:08:43Z",
+        },
+    },
+    {
+        "value": "peste.bi.wealthsimple.co",
+        "type": "Domain",
+        "fields": {
+            "tags": "DomainToolsFeeds,noh",
+            "service": "DomainTools Feeds",
+            "firstseenbysource": "2025-04-23T15:08:43Z",
+            "sourcebrands": "FeedDomainTools",
+        },
+        "rawJSON": {
+            "value": "peste.bi.wealthsimple.co",
+            "type": "Domain",
+            "timestamp": "2025-04-23T15:08:43Z",
+        },
+    },
+    {
+        "value": "jdagdhdilukte2ajaiya-pqb6kc-b9a8d2c13-clientnsv4-s.akamaihd.net",
+        "type": "Domain",
+        "fields": {
+            "tags": "DomainToolsFeeds,noh",
+            "service": "DomainTools Feeds",
+            "firstseenbysource": "2025-04-23T15:08:43Z",
+            "sourcebrands": "FeedDomainTools",
+        },
+        "rawJSON": {
+            "value": "jdagdhdilukte2ajaiya-pqb6kc-b9a8d2c13-clientnsv4-s.akamaihd.net",
+            "type": "Domain",
+            "timestamp": "2025-04-23T15:08:43Z",
+        },
+    },
+]
+
 
 DOMAINDISCOVERY_PARSED_INDICATOR_RESPONSE = [
     {
@@ -362,7 +528,7 @@
         "rawJSON": {
             "value": "yashh.xin",
             "type": "Domain",
-            "timestamp": "2025-03-07T17:27:11Z"
+            "timestamp": "2025-03-07T17:27:11Z",
         },
     },
     {
diff --git a/Packs/FeedDomainTools/README.md b/Packs/FeedDomainTools/README.md
index d8a45b0c736e..9bb1afbc5a95 100644
--- a/Packs/FeedDomainTools/README.md
+++ b/Packs/FeedDomainTools/README.md
@@ -1,2 +1,2 @@
 Real-Time Threat Intelligence Feeds provide data on the different stages of the domain lifecycle: from first-observed in the wild, to newly re-activated after a period of quiet. Newly Active Domains surfaces apex-level domains seen for the first time or after ten or more days of inactivity. Newly Observed Domains surfaces domains that we observe for the first time.
-This integration was integrated and tested with version 1.0.0 of FeedDomainTools.
\ No newline at end of file
+This integration was integrated and tested with version 1.0.3 of FeedDomainTools.
\ No newline at end of file
diff --git a/Packs/FeedDomainTools/ReleaseNotes/1_0_2.md b/Packs/FeedDomainTools/ReleaseNotes/1_0_2.md
index b2813be4e03b..11735ba811ff 100644
--- a/Packs/FeedDomainTools/ReleaseNotes/1_0_2.md
+++ b/Packs/FeedDomainTools/ReleaseNotes/1_0_2.md
@@ -4,4 +4,3 @@
 ##### FeedDomainTools
 
 - Updated the Docker image to: *demisto/vendors-sdk:1.0.0.3242986*.
-
diff --git a/Packs/FeedDomainTools/ReleaseNotes/1_0_3.md b/Packs/FeedDomainTools/ReleaseNotes/1_0_3.md
new file mode 100644
index 000000000000..cc6d912c5acc
--- /dev/null
+++ b/Packs/FeedDomainTools/ReleaseNotes/1_0_3.md
@@ -0,0 +1,6 @@
+
+#### Integrations
+
+##### FeedDomainTools
+
+- Added the `noh` (newly-observed-hostnames) domaintools feed.
diff --git a/Packs/FeedDomainTools/pack_metadata.json b/Packs/FeedDomainTools/pack_metadata.json
index bdbbc228d3ce..eae51a884d56 100644
--- a/Packs/FeedDomainTools/pack_metadata.json
+++ b/Packs/FeedDomainTools/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "DomainTools Feed",
     "description": "Indicators feed from DomainTools",
     "support": "partner",
-    "currentVersion": "1.0.2",
+    "currentVersion": "1.0.3",
     "author": "DomainTools",
     "url": "https://www.domaintools.com/support/",
     "email": "memberservices@domaintools.com",


Reviews:
user: login: jbabac
body: LGTM!
state: APPROVED
author_association: NONE
submitted_at: 2025-04-28T19:01:56Z
user: login: MosheEichler
body: Hi @contributor_user,
Thank you for your contribution!
Good work :)

* Please update the integration README (line 46) add the new type to the possible values
* Please revert the unrelated Release notes file (1_0_2)

Feel free to reach out to me with any questions - I'm available here or on slack :)
Thanks again
state: CHANGES_REQUESTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-29T09:39:23Z
user: login: briluza
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-29T12:52:44Z
user: login: MosheEichler
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-29T13:14:15Z

Review comments:
path: Packs/FeedDomainTools/ReleaseNotes/1_0_2.md
user: login: MosheEichler
body: Please revert
created_at: 2025-04-29T09:08:05Z
author_association: CONTRIBUTOR
path: Packs/FeedDomainTools/ReleaseNotes/1_0_2.md
user: login: briluza
body: done updating the README. 
created_at: 2025-04-29T12:52:44Z
author_association: CONTRIBUTOR

PR comments:
user: login: content-bot
created_at: 2025-04-28T17:53:41Z
body: Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the [Contribution Registration](https://forms.gle/XDfxU4E61ZwEESSMA) form, so our content wizard @MosheEichler will know the proposed changes are ready to be reviewed.
For your convenience, here is a [link](https://xsoar.pan.dev/docs/contributing/sla) to the contributions SLAs document.
author_association: CONTRIBUTOR
user: login: content-bot
created_at: 2025-04-28T17:53:43Z
body: Hi @briluza, thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution please follow this [link](https://xsoar.pan.dev/docs/packs/packs-format#contributorsjson).
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-04-29T13:16:11Z
body: Thank you for your contribution. Your external PR has been merged and the changes are now included in an internal PR for further review. The internal PR will be merged to the master branch within 3 business days.
author_association: NONE