Before
Analysts likely had to open US-CERT alerts, inspect PDF reports, identify domains and IP addresses, and look up each indicator separately. They then had to compile WHOIS and malicious-score findings into an email and provide blocking instructions or links for review.
How it works
- Retrieve the US-CERT alert feed and identify PDF-based security reports for processing.
- Parse the report content into domain and IPv4 indicators, then enrich each indicator with domain or IP intelligence.
- Assemble the findings into an email review report with human-initiated blocking links.
Workflow details
- Feed collection: The workflow retrieves the US-CERT RSS alert feed and scans the response for PDF links, retaining up to three matching entries for the processing loop.
- IOC extraction: Each processing cycle uses an IOC parsing step to obtain domain and IPv4 indicators from a configured security report, creating separate collections for domain and IP analysis.
- Domain enrichment: Every identified domain is checked through VirusTotal, and the workflow captures the domain identifier and WHOIS information for the review report.
- IP enrichment: Each identified IPv4 address is also checked through VirusTotal, with the malicious detection score captured for the IP report.
- Review and action handoff: The workflow formats the findings into an HTML email report and includes links that allow a reviewer to request domain or IP blocking through a separate blocking action. Blocking is presented for human approval rather than executed automatically by the workflow.
What changed
Indicator enrichment and report assembly now happen inside one workflow after the feed is retrieved. Reviewers receive structured findings with blocking actions attached to the relevant indicators, while the final blocking decision remains human initiated.
Work removed
Opening alert reports one by one, extracting domain and IP indicators, performing separate domain and IP intelligence lookups, recording WHOIS and malicious scores, building the HTML report, and manually composing the review email with blocking links.
Expected outcome
Expected result: one consolidated review email per run, with up to three extracted PDF links selected for processing and one automated enrichment lookup for each parsed domain or IPv4 indicator; blocking still requires reviewer action.
