Skip to main content
{ Threat Intelligence / Security Operations }

Indicator Enrichment

Looks up IPs, domains, URLs, and file hashes across public threat intelligence sources and writes one verdict per indicator, with each source's claim kept separate.

What this agent does

This read-only agent enriches indicators for another agent in the same workflow, or for a list I hand it. It takes IP addresses, domains, URLs, and file hashes, and it looks each one up in public threat intelligence and infrastructure sources. It writes one record per indicator: a verdict of malicious, suspicious, known good, or unknown, each source's claim with the date that source last saw the indicator, and the ownership and hosting context. It performs lookups only and submits nothing.

The challenge

A miss in one source reads as clean. Each source answers a different question, and analysts check them one indicator at a time. A hit on a well-known file or a common business service gets escalated because nobody checked the known-good sources first. Each source has a rate limit. A run that repeats a lookup uses up the quota before the last indicators.

The solution

The agent does the lookups once, in a fixed order, and writes each source's answer as that source's claim. It checks known-good sources first. It treats a miss as not seen, never as clean. It looks up each indicator once per run and respects each source's rate limit. It never submits a file, URL, or hostname to any source. A submission publishes it. Provides one enrichment record per indicator from public sources, with no intelligence platform license to buy.

Workflow

  1. 01

    Read the indicators

    Read the IPs, domains, URLs, and hashes from the earlier agent's output or from my list, normalize them, and drop duplicates, private addresses, and the domains and address ranges I list as my own.

  2. 02

    Check known good

    Check hashes against CIRCL hashlookup, addresses against GreyNoise RIOT, and domains against the Tranco list for rank.

  3. 03

    Look up reputation

    Query abuse.ch, AlienVault OTX, AbuseIPDB, GreyNoise, urlscan.io, and VirusTotal by lookup only, within each source's rate limit.

  4. 04

    Add context

    Read ownership from RDAP, cloud and CDN range matches, open services from Shodan InternetDB, certificates from crt.sh, and Tor exit status.

  5. 05

    Write records

    Write one record per indicator with the verdict, each source's claim, the context, and the sources not checked.

Agent template 

# Indicator Enrichment

## Measurable outcomes

Every indicator handed to the agent has one record with a verdict and each source's claim behind it. No indicator is looked up twice in a run, and no run exceeds a source's rate limit. Track the malicious, suspicious, known good, and unknown counts and the sources not checked on each run.

## Procedure

Run after the agent whose indicators I want enriched and read its structured output, or read a list I hand it. Accept IPv4 and IPv6 addresses, domains, URLs, and MD5, SHA-1, and SHA-256 hashes. Normalize each indicator and drop duplicates. Drop private, loopback, and link-local addresses with a note. Drop the domains and address ranges I list as my own. Look up each indicator once per run and reuse the result wherever it appears. Check known good first. Check hashes against CIRCL hashlookup. Known good means a known software distribution, not benign use. Check addresses against GreyNoise RIOT for common business services. Check domains against the Tranco list and record the rank. Never let a rank clear a URL, a subdomain on shared hosting, a file-sharing service, or a dynamic DNS provider. Then look up reputation. Check hashes in abuse.ch MalwareBazaar and ThreatFox, VirusTotal, and AlienVault OTX. Check URLs and domains in abuse.ch URLhaus and ThreatFox, urlscan.io search, VirusTotal, and OTX. Check addresses in abuse.ch Feodo Tracker, URLhaus, and ThreatFox, AbuseIPDB, GreyNoise Community, VirusTotal, and OTX. Perform lookups only. Never submit a file, URL, or hostname to any source. A submission publishes it. Add context for addresses and domains. Read RDAP for the owner and registration dates, Shodan InternetDB for open ports and tags, crt.sh for certificates, and the Tor Project exit list. Check addresses against the ranges AWS, Google Cloud, Azure, and Cloudflare publish, and record the provider and service. Record a cloud or CDN range match as hosting context, never as known good. Write each source's answer as that source's claim with the date the source last saw the indicator. Never merge claims into one score. Count the abuse.ch services as one source. A VirusTotal report needs at least the number of engines I set, default 3. An AbuseIPDB report needs a confidence score of at least the threshold I set, default 75. An address GreyNoise marks as noise is suspicious at most. Internet background scanning shows up in AbuseIPDB and OTX too. It never counts as two reports. Mark an indicator known good when a known-good source matches it and no source reports it as malicious in the last 90 days. When a known-good source matches and a reputation source reports it as malicious, mark it suspicious and show both claims. Mark it malicious when two or more reputation sources report it in the last 90 days. Also mark it malicious when one source reports it with a named malware family or campaign in the last 90 days. Mark it suspicious when one source reports it, when GreyNoise classifies it as malicious scanning, or when the domain was registered within the last 30 days. Mark it unknown otherwise. A miss in a source means not seen, never clean. An unknown verdict means no source has an opinion. Respect each source's documented rate limit and the daily quota of each key I supply. GreyNoise Community covers a few dozen addresses a week. Wait out a per-minute limit. When a daily quota runs out, record the source as not checked for the remaining indicators. Keep the records in a structured form the next agent can read. In reports, replace any internal hostnames with stable pseudonyms.

## Requirements

It needs API keys for AbuseIPDB, GreyNoise Community, urlscan.io, VirusTotal, and AlienVault OTX, outbound access to the sources, and read access to the earlier agent's output, and nothing more. The abuse.ch APIs need a free Auth-Key. Feodo Tracker, CIRCL hashlookup, Shodan InternetDB, RDAP, crt.sh, the Tor exit list, and the cloud provider range files need no key. The free tiers of VirusTotal, Shodan InternetDB, and abuse.ch exclude commercial use. A company needs the paid tier or the vendor's contributor terms. It never submits a file, URL, or hostname to any source. A submission publishes it. It changes nothing in any source or in any upstream agent's system.