What problem does it solve? Analysts waste significant triage time manually looking up indicators of compromise across multiple threat intelligence sources. This Skill automates multi-source IOC enrichment so SIEM alerts arrive pre-populated with VirusTotal, AbuseIPDB, Shodan, and MISP context, reducing mean time to triage. ## Core Features & Use Cases - Multi-source enrichment pipeline: Enriches IPs, domains, URLs, and file hashes through VirusTotal, AbuseIPDB, Shodan, and MISP with a composite confidence score. - SOAR playbook design: Step-by-step guidance for building enrichment playbooks in Cortex XSOAR, Splunk SOAR, Tines, or TheHive with parallel fan-out and conditional alert routing. - Rate limiting and STIX export: Built-in rate limit handling, retry-on-429 logic, and export of enriched indicators as STIX 2.1 bundles. - Use Case: A phishing email submission pipeline extracts 50 IOCs per day; the included Python agent enriches each one, scores confidence, and exports STIX indicators for the TIP. ## Quick Start Run the enrichment agent on a file of IOCs by asking the AI to enrich the indicators in your IOC list using your VirusTotal and AbuseIPDB API keys and export the results as a STIX bundle.
