performing-ioc-enrichment-automation - Automate Multi-Source IOC Enrichment
Enriches IPs, domains, URLs, and file hashes across multiple intelligence sources with risk scoring and disposition recommendations.
Tags
Updated: 2026-10-02Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Enrich IPs, domains, and hashes
- Query threat intelligence sources
- Calculate composite risk scores
- Assign disposition recommendations
- Cross-reference organizational intelligence
- Integrate SOAR workflows
Inputs
- IP addresses
- Domain names
- URLs
- File hashes
- Threat intelligence API keys
- MISP instance or TIP
Outputs
- Enrichment results
- Risk scores
- Disposition recommendations
- IOC context records
Requirements
- Python 3.8 or later
- requests library
- vt-py library
- shodan library
- VirusTotal API key
- AbuseIPDB API key
- Shodan API key
- URLScan.io API key
- GreyNoise API key
- MISP instance or TIP
- API rate-limit awareness
