enrich-ioc

What problem does it solve?

Enrich IOC indicators with GTI and Chronicle SIEM context to produce threat intelligence findings and contextual summaries.

Core Features & Use Cases

• GTI enrichment for IPs, domains, file hashes, and URLs to surface reputation and contextual context
• SIEM entity lookup to attach first/last seen, related alerts, and assets
• IOC match assessment to determine if the indicator appears in threat feeds and generate a THREAT_SCORE and MALICIOUS_CONFIDENCE
• Use case: During an investigation, enrich a suspected IOC to quickly determine its threat posture and related indicators

Quick Start

Enrich an IOC value using GTI and Chronicle SIEM to return threat intel findings, SIEM entity summary, and IOC match status.