Before
An analyst likely had to enter the IP address separately into multiple threat intelligence and geolocation services. They then had to compare the returned values, copy the relevant findings, and manually assemble a summary in Slack.
How it works
- Receive an IP address from the Slack analysis command.
- Retrieve threat intelligence from VirusTotal and URLScan, then enrich the result with country, region, city, and location data from IPinfo.
- Combine the findings into a formatted Slack message, stopping the workflow if a required service lookup fails.
Workflow details
- Trigger: An analyst enters the `/analyze-vt` command in Slack with an IP address, starting the workflow from the command text.
- Threat analysis: The workflow checks the IP in VirusTotal for malicious, undetected, suspicious, and harmless detection counts, along with its reputation. It also searches URLScan for related results and retrieves the relevant scan verdict information, including the overall score, malicious status, and verdict availability.
- Location enrichment: The same IP is queried through IPinfo to obtain country, region, city, and geographic coordinates.
- Validation and continuity: Each service step is configured to stop the execution if it fails, preventing the workflow from continuing with an incomplete result set.
- Delivery: The collected findings are assembled into a rich Slack message showing the submitted IP, threat indicators, URLScan verdict details, and geographic information in a single channel response.
What changed
The IP analysis now starts from a single Slack command and automatically performs the threat intelligence, scan-result, and geolocation lookups before delivering one consolidated response in Slack. Analysts no longer need to coordinate separate searches or assemble the findings manually, while failed service steps prevent an incomplete summary from being sent.
Work removed
Entering the same IP into three separate lookup services, reviewing the returned detection and location fields, copying findings between tools, and manually composing and posting the Slack summary.
Expected outcome
At least three separate lookups and one manual summary step can be replaced for each IP investigation, with the findings delivered in one Slack response; actual time savings depend on service response times and analyst review.
