Before
An analyst would likely search the IP address separately in several threat-intelligence tools, switch between results, and compare the findings manually. The relevant responses would then need to be gathered and organized before an overall assessment could be made.
How it works
- Receive the IP address from a webhook and begin the enrichment run.
- Query multiple threat-intelligence sources sequentially to collect reputation, activity, and analysis findings.
- Extract and normalize the meaningful results into one aggregated enrichment output.
Workflow details
- Trigger: The workflow starts when a webhook provides an IP address to investigate.
- Multi-source enrichment: It queries three independent IP intelligence services in sequence to retrieve reputation, threat activity, and analysis information for the same address.
- Data preparation: The workflow extracts the meaningful response data from each lookup, including the detailed first-source response, the third-source analysis statistics, and the second-source search results.
- Aggregated result: It normalizes these outputs into a single set of enrichment fields that can support aggregated verdicts from multiple tools. If an enrichment request fails, the workflow stops rather than continuing with an incomplete result.
What changed
A single webhook-triggered run now performs the three IP lookups in sequence and prepares their meaningful results in normalized fields. Analysts receive a consolidated enrichment output instead of manually comparing separate service responses, while failed lookups stop the workflow before an incomplete result is produced.
Work removed
Manually entering the same IP address into three separate intelligence searches, switching between tools, reviewing each response, copying relevant findings, and organizing the results into a combined record.
Expected outcome
At least three separate lookup actions and the associated result-compilation steps are consolidated into one automated run for each IP investigation.
