All use cases

Automated Multi-IOC Threat Analysis

This automation analyzes a submitted list of indicators of compromise using VirusTotal and produces a consolidated summary. It replaces repeated individual IOC reviews with one structured analysis result for the requesting process or analyst.

Analysis

Enrichment

Network threat

Threat detection

Trigger

A required array of indicators of compromise submitted to the flow.

Outcome

A consolidated text summary of the VirusTotal-based analysis of the submitted IOCs.

Trigger

A required array of indicators of compromise submitted to the flow.

Outcome

A consolidated text summary of the VirusTotal-based analysis of the submitted IOCs.

Before

An analyst would likely initiate analysis for individual IOCs, review the resulting information, and assemble the findings into a combined summary. This process depended on repeated lookups and manual consolidation before the results could be shared or used.

How it works

Receive a list of IOCs through the flow trigger.
Analyze the submitted indicators with VirusTotal capabilities while avoiding file uploads through API endpoints.
Return the agent's consolidated analysis summary as the workflow result.

Workflow details

Trigger: The workflow starts when it receives a required list of IOCs for analysis.
Analysis: An agent reviews the submitted indicators using VirusTotal capabilities, while following the instruction not to upload files through VirusTotal API endpoints.
Reasoning: The agent evaluates the available information for the incoming IOC set and consolidates the analysis rather than treating the request as disconnected individual lookups.
Summary: The workflow generates a text-based summary of the analysis performed.
Delivery: The completed summary is returned as the flow result to the caller for subsequent review or use.

What changed

IOC analysis now begins from one submitted list and produces a consolidated result automatically, leaving the human with the task of reviewing the completed summary rather than coordinating each analysis and compiling the findings.

Work removed

Manually initiating analysis for each IOC, reviewing individual results, and assembling the findings into a single summary.

Expected outcome

Each submitted batch is expected to produce one consolidated analysis summary, removing at least one manual aggregation step per batch.

Connected tools

Related flows

All use cases

Explore more workflows with similar topics or tools.

Automated Security Alert Enrichment

This automation runs a complex query against Log Analytics to retrieve Azure Sentinel alerts or other security logs, converts the returned data into JSON, and uses it to update security alerts with additional information. It replaces a manual search-and-update process with a consistent enrichment workflow.

Explore use case

Automated IOC Fleet Triage

This automation enriches a medium-severity security alert by investigating indicators, alerts, detects, and device telemetry across the environment. It delivers a concise triage summary showing how widely a hash has executed, details for the primary host, and a recommendation on whether the activity is a widespread false positive or an isolated anomaly.

Explore use case

Scheduled Printer Exposure Mapping

This automation runs scheduled network searches to identify exposed printers and printer services visible on the public internet. When matches are found, it compiles their product, protocol, host, port, hostname, location, and banner details into a formatted spreadsheet and shares the report with the responsible team.

Explore use case

Less busywork. More possibility.

Let your agents handle the routine. Make room for what comes next.

Let’s talk