Security playbook · AI Employee: Sig

IOC Enrichment & Lookup

Analyst enrichment step from minutes to seconds

Install this playbookBack to marketplace
The problem

During any security investigation, analysts spend most of their time on manual IOC lookup: is this IP a known-bad, does this hash match a known malware, has this domain been seen in prior incidents, what's the reputation of this executable. Each lookup takes 2-5 minutes across multiple sources (VirusTotal, threat intel platforms, internal history). An investigation with 30 IOCs takes hours before analysis can even begin.

At a glance
Trigger
Chat
Approvals
None
What it does
Read-only
Systems
Threat intel APIs · VirusTotal · Internal telemetry
How it feels in production

An hour-by-hour walkthrough.

Alert fires: suspicious PowerShell execution on Priya's laptop. IOCs extracted: hash abc123..., IP 45.67.89.10, domain evil.example.com, filename dropper.exe. Sig runs IOC enrichment on all four in parallel (5 seconds total): - Hash abc123: VirusTotal 42/70 detections, first seen 2024-11, family Emotet variant, matches internal prior incident INC-2025-0847 - IP 45.67.89.10: Cloudflare-fronted, known-malicious per 3 feeds, associated with Emotet C2 infrastructure since 2024-08 - Domain evil.example.com: registered 2024-11 (recent), Cloudflare-fronted, matches known-malicious pattern (typosquat), 4 sub-domains flagged - Filename dropper.exe: no direct match, but path C:\Users\Public\dropper.exe matches Emotet installer pattern Sig produces the enrichment bundle: confidence-high Emotet infection, related to prior INC-2025-0847, recommend immediate containment (isolate device + revoke sessions + notify user) + full incident investigation. Analyst arrives to a fully-enriched incident with the story already told. Investigation starts from analysis, not from lookup. Response time drops from hours to minutes.
How it works

Step by step.

  1. 01

    Extract IOCs from alerts + investigations

    Hashes, IPs, domains, filenames, URLs, registry keys. Extraction from various alert formats (EDR, SIEM, DFIR notes).

    EDR · SIEM · DFIR notes · IOC extractor
  2. 02

    Parallel enrichment across every source

    VirusTotal, threat intel platforms, DNS reputation, internal history. All in parallel with rate-limit management.

    VirusTotal · Recorded Future · Mandiant · DomainTools · Internal DB
  3. 03

    Correlate + score confidence

    Multi-source correlation. Confidence scoring based on independent-source agreement. Family / campaign identification.

    Correlation engine · Confidence model · Threat family library
  4. 04

    Deliver bundled context to analyst

    Full enrichment bundle with related history + recommended actions. Analyst starts from story, not from raw IOCs.

    Slack · Teams · Investigation UI
  5. 05

    Feed IOCs into detection + blocklists

    Confirmed-malicious IOCs auto-added to blocklists (firewall, DNS, EDR). Detection rules created for pattern-based IOCs.

    Firewall · DNS RPZ · EDR rules · Detection engineering
Systems and wiring

What you connect to make this run.

VirusTotal · Mandiant · Recorded Future · CrowdStrike Intel

read

External threat intel platforms. Rate-limited + cached to avoid quota exhaustion.

DomainTools · WHOIS · DNS history

read

Domain + IP context. Registration age, ownership history, associated infrastructure.

Internal incident history · IOC database

read+write

Prior IOC sightings + internal attribution. Compounds over time as more incidents feed the database.

Firewall · DNS RPZ · EDR blocklists

write

Confirmed-malicious IOCs auto-blocked. Blocks prevent recurrence + protect against similar future patterns.

What changes

Before and after, honestly.

Time to enrich a set of IOCs
Before
20-60 minutes (30 IOCs)
After
10-30 seconds
% of investigations with complete enrichment
Before
40-60%
After
99%+
Analyst investigation start-to-first-action
Before
1-4 hours
After
10-30 minutes
Detection coverage from confirmed-malicious feed
Before
Manual + inconsistent
After
Automatic + comprehensive
Related

Playbooks that pair with this one.

Security

Security Alert Triage & Context

Enrichment feeds the triage context; joint pipeline.

Security

Incident Response Orchestration

IR uses enrichment as foundational context.

Security

Vulnerability Remediation Requests

CVE + IOC correlation for exploit-in-the-wild scoring.

Frequently asked

Answers about this playbook.

What about false-positive risk (IOCs marked malicious that aren't)?

Multi-source confidence required for automatic action. Single-source detection triggers analyst review, not auto-block. False-positive feedback tuned into confidence model.

How does it handle IP infrastructure that's mixed-use (Cloudflare, AWS)?

Infrastructure-context aware. Cloudflare IP not blocked as-is; matched against Cloudflare-fronted-domain reputation instead. Prevents blocking legitimate traffic.

What about proprietary or classified threat intel?

Government / classified feeds handled with appropriate access control. Enrichment respects source restrictions; not all intel visible to all analysts.

Can it enrich retroactively (historical IOCs)?

Yes — retroactive enrichment for closed incidents when new intel becomes available. Compounds intelligence over time.

How does it interact with our SOAR platform?

SOAR integrates enrichment as a stage in playbooks. Enrichment API called by SOAR; results feed downstream playbook logic.

See it run on your data.

Free plan, no credit card. Connect the systems this playbook needs and run it against a past event first.

Book a demoMore Security playbooks