Before
Security analysts likely had to review each indicator individually, determine its type, and select the appropriate lookup method. They then had to repeat the searches across the relevant threat-intelligence views and consolidate the findings for operational review.
How it works
- Receive a list of IOCs through a secure webhook and prepare each indicator for processing.
- Identify whether each item is a URL, domain, hash, or IP address, then route it to the corresponding threat-intelligence lookup.
- Return the completed workflow result after the relevant threat context has been retrieved for each indicator.
Workflow details
- Intake: A secure webhook receives a list of Indicators of Compromise, including hashes, domains, URLs, and IP addresses, and prepares the items for individual processing.
- Classification: Each submitted indicator is processed sequentially and routed according to its type, ensuring that the relevant analysis path is used for the specific indicator format.
- Threat enrichment: The workflow queries Recorded Future for the matching indicator and retrieves relevant intelligence, including risk information, sightings, metrics, analyst notes, threat lists, and related entities where available.
- Result preparation: After the applicable lookup is completed for each item, the workflow returns a completion response containing the resulting workflow data for downstream use.
- Operational value: The automation standardizes IOC analysis across common indicator types and reduces the need for analysts to perform separate searches and manually gather threat context for every submitted item.
What changed
IOC analysis now starts automatically when a list is submitted, with type-based routing and sequential threat-intelligence lookups performed without analyst intervention. The resulting workflow data is returned through the completion response, leaving analysts to interpret the findings rather than conduct each initial search.
Work removed
Manually identifying each IOC type, selecting the correct lookup path, entering indicators into separate searches, and gathering the resulting risk, sightings, threat-list, and related-entity details.
Expected outcome
The workflow can replace at least one manual lookup and classification cycle for each submitted IOC, producing more consistent initial threat context across the full list.
