Results for “ip-enrichment”

Automates multi-source enrichment of IPs, domains, URLs, and file hashes using VirusTotal, AbuseIPDB, Shodan, GreyNoise, URLScan.io, and MISP to provide contextual risk scoring and disposition recommendations for SOC analysts.

Automates enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standardize enrichment outputs.

Build automated threat intelligence enrichment pipelines in Splunk Enterprise Security using lookup tables, modular inputs, and the Threat Intelligence Framework.

Triages and enriches indicators of compromise (IPs, domains, file hashes, URLs, email artifacts) from phishing emails, security alerts, or threat feeds, assigning confidence scores and dispositions using VirusTotal, AbuseIPDB, MalwareBazaar, and MISP.

Build an automated IOC enrichment pipeline using OpenCTI's connector ecosystem to enrich indicators with context from VirusTotal, Shodan, AbuseIPDB, GreyNoise, and other sources.

Enrich IP addresses with Shodan API data to identify open ports, running services, known vulnerabilities, and hosting context for threat intelligence and incident triage.

Build an automated pipeline to defang indicators of compromise (URLs, IPs, domains, emails) for safe sharing and distribute them in STIX format through TAXII feeds and threat intelligence platforms.

NN/g-grounded page enhancement for flows and semantic data wiring — not visual polish. Use when "this page feels AI-generated", "fix UX of /xxx", "improve information density", or "icons all look the same". Composition/type → enhance-web-ui. Heuristics-only → audit-ux.

Audit, improve, and compress every skill in the repo using live research. Load when the user asks to improve skills, audit the skill library, upgrade existing skills, refresh with new research, do a skill health check, or says "improve all skills", "update the skill library", "skill audit", or "run an improvement pass". Applies live domain research, fixes structural gaps, checks for skill linking opportunities, then rewrites and resizes each skill. Supports TARGETED mode (`TARGET=<skill> [SKIP_RESEARCH=true]`) for single-skill fixes, including learn-from-chat restructure escalations. All skills are in scope including meta skills.

Deploy and integrate open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified threat intelligence platform for collecting, analyzing, enriching, and disseminating threat intelligence.

Deploy MISP, configure threat feeds, use the PyMISP API for programmatic access, and build automated collection pipelines that aggregate IOCs from multiple community and commercial sources.

Ingests, normalizes, and enriches structured and unstructured threat intelligence feeds into STIX 2.1 format, evaluating feed quality and deduplicating indicators for distribution to SIEM, firewall, and EDR platforms.

Provides access to Greip API endpoints for geolocation, IP lookup, threat intelligence, payment scoring, email and phone validation, profanity detection, and account management.