Before
An analyst likely copied each IP, domain, URL, or file hash into separate intelligence consoles and repeated searches for indicators not already covered by internal intelligence. The results then had to be reconciled with the original alert while avoiding unnecessary checks and private addresses.
How it works
- Receive the indicators and query the internal intelligence store in one consolidated lookup.
- Identify unresolved, supported indicators, exclude private or unsupported values, and perform limited reputation lookups.
- Normalize all findings and return the results, skipped values, counts, and errors to the investigation.
Workflow details
- Receive and prioritize: The workflow accepts a list of observables such as IP addresses, domains, URLs, email addresses, and file hashes, then prepares them for a consolidated intelligence lookup.
- Check internal intelligence: It sends eligible indicators to OpenCTI in a single query and normalizes available scores, labels, indicator details, reports, relationships, and unresolved values. If there is nothing to query, it returns an empty result rather than performing unnecessary work.
- Filter secondary lookups: Indicators not resolved internally are converted into the appropriate lookup form for supported IP, domain, file-hash, and URL types. Private IPv4 addresses are excluded, unsupported types are marked as skipped, and no files or URLs are uploaded.
- Retrieve reputation evidence: VirusTotal reports are consulted for eligible unresolved indicators, with a maximum of 10 lookups and up to two processed in parallel. Failures or unavailable reports do not prevent the remaining checks from continuing.
- Return investigation-ready results: The workflow summarizes reputation, malicious and suspicious counts, harmless and undetected results, tags, categories, ownership, country, dates, and report links, alongside OpenCTI matches, unresolved indicators, the number checked, and any error information.
What changed
Internal intelligence is checked before any secondary lookup, and only unresolved supported indicators proceed to consultation. The investigation receives a structured result that separates existing matches, unresolved values, skipped indicators, and secondary reputation evidence without requiring manual result matching.
Work removed
Copying indicators into multiple intelligence consoles, repeating lookups for values already known internally, excluding private or unsupported indicators, tracking the secondary checks performed, and reconciling individual reports with the investigation.
Expected outcome
One internal intelligence query and up to 10 targeted secondary lookups replace repeated indicator-by-indicator searches, with fewer duplicate reputation checks during alert investigation.
