Before
Security staff likely extracted IPv4 addresses from incoming data, submitted them individually for threat intelligence checks, and reviewed the returned reports for malicious findings. They then had to copy the relevant IP, malicious assessment, and reputation details into an email for the security team.
How it works
- Receive an array of IP addresses and isolate the IPv4 addresses that can be evaluated.
- Analyze each eligible address with VirusTotal Enterprise and assess the returned malicious and reputation information.
- Compile the findings into an email report for the configured security recipient.
Workflow details
- Ingestion: The workflow begins when an array of IP addresses is submitted through a webhook, providing a batch of addresses for threat intelligence analysis.
- Address filtering: Each item is processed individually, with the workflow extracting IPv4 addresses so that only addresses supported by the enrichment service continue through the analysis.
- Threat analysis: Every eligible IPv4 address is evaluated through VirusTotal Enterprise, which provides the report data used to determine whether the address is malicious and to capture its reputation information.
- Decision handling: The workflow uses the returned report status to identify bad addresses and prepare the relevant findings for notification rather than requiring an analyst to review every address manually.
- Reporting: A formatted email report is sent to the configured recipient with the analyzed IP address, malicious assessment, and reputation details, giving the security team a ready-to-review result.
What changed
IP enrichment and report preparation now occur automatically for each eligible address, with the malicious assessment and reputation details assembled into an email handoff. The security team receives the formatted findings without waiting for an analyst to perform individual lookups and compile the report.
Work removed
Manually extracting IPv4 addresses, submitting addresses one by one for analysis, reviewing threat reports, identifying malicious findings, copying reputation details, and composing the notification email.
Expected outcome
At least one manual lookup and one manual report-compilation handoff can be avoided for each IPv4 address processed, while the security team receives consistent threat intelligence notifications.
