Domain Registration — Detection Telemetry

Collection and providers

Query an approved RDAP service/feed, retaining retrieval time and registration-event dates; preserve redaction and missing-field indicators.

• Authorized intelligence feeds / STIX repositories: Provenance-bearing observations and analysis, not direct victim-side logs.
• RDAP registries/registrars: Registration context; public fields can be redacted or unavailable.

Configuration

• Use an approved feed/API or documented lawful export. Store retrieval time, source URL, original record ID, observation time and confidence separately.
• Retain the raw response, licensing constraints and analyst assessment. Deduplicate observations without erasing independent provenance.
• Correlate external context with authorized internal observations; do not label ownership, attribution or compromise from a shared indicator alone.

Synthetic event example

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0101",
  "collector": "illustrative-lab-collector",
  "observation": {
    "domain": "example.test",
    "event": "registration",
    "registrant": "redacted",
    "retrieved_at": "2026-09-27T12:00:00Z"
  }
}

Visibility and validation

Coverage, licensing, redaction and reporting delays vary. External context is not proof of access to the target, and cannot substitute for unavailable provider-side audit.

• Record the lab scope, collector version, effective configuration and expected source fields before testing.
• Use an approved benign action or read-only snapshot appropriate to this type. For destructive, privileged or physical effects, use a reviewed fixture or existing authorized evidence instead of causing the effect.
• Verify the native source record locally and at the collector; compare timestamps, identity, object, action/result and the type-specific fields listed below. Save a redacted real capture separately from the synthetic example.
• Check a normal baseline and collector-loss case. Fixture parsing proves parser behavior only; it does not prove sensor coverage or malicious-behavior detection.

Primary sources

• OASIS STIX 2.1 specification
• ICANN Registration Data Access Protocol