Enriching IOCs with Threat Intel Sources

When to Use

• You have atomic indicators and need context: reputation, related infrastructure, first/last seen, and known associations.
• You are scoring indicator confidence before acting or reporting.
• You must plan lookups without leaking your investigation to the adversary.

Do not use active interaction (visiting a C2 URL, resolving a live domain from your own network) for enrichment — use passive sources to avoid tipping off the adversary.

Prerequisites

• Defanged indicators (from the defanging skill) and access to enrichment sources/APIs.
• Awareness of each source's operational-security implications.

Safety & Handling

• Prefer passive sources (passive DNS, sample DBs, reputation feeds) over active probing.
• Never submit a customer/internal sample to a public sandbox without authorization — it becomes publicly retrievable and can expose sensitive data.

Workflow

Step 1: Group indicators by type

Separate hashes, domains, IPs, and URLs; each maps to different enrichment sources.

Step 2: Plan the right lookups

Map each type to passive sources: hashes → sample/AV databases; domains → passive DNS, WHOIS, reputation; IPs → ASN/geo, passive DNS, reputation; URLs → URL reputation/sandbox history.

python scripts/analyst.py plan iocs.json

Step 3: Score confidence

Combine source agreement, age, and prevalence into a confidence score; a single hit on one feed is weaker than corroboration across independent sources.

Step 4: Annotate and pivot

Attach context (first seen, related infrastructure, family) and pivot on strong links (shared registrant, hosting, certificate) to expand the picture.

Step 5: Record provenance

Note which source provided each piece of context and when, so the enrichment is auditable and re-checkable.

Validation

• Each indicator is routed to type-appropriate, passive sources.
• Confidence reflects corroboration across independent sources, not a single feed.
• Every enrichment carries source and timestamp provenance.

Pitfalls

• Actively resolving/visiting live infrastructure and alerting the adversary.
• Uploading sensitive samples to public services, leaking data.
• Treating one feed's verdict as ground truth without corroboration.

References

• See references/api-reference.md for the lookup planner.
• MITRE ATT&CK and passive-DNS enrichment concepts (linked in frontmatter).