Ioc Enrichment Workflow

IOC Enrichment Workflow

This workflow defines how to enrich raw indicators of compromise by routing them to the appropriate /lookup-* skills and synthesising results.

Seeding the queue (optional): when you don't already have a batch but want fresh leads, /lookup-crowdstrike indicators --malicious --since 7d [--type … | --actor …] returns the latest high-confidence CrowdStrike IOCs (newest-first). Feed the returned indicators into the per-type routing below to enrich each. Requires CrowdStrike credentials with the Indicators read scope.

This skill invokes: /lookup-liberty91, /lookup-virustotal, /lookup-abuseipdb, /lookup-greynoise, /lookup-shodan, /lookup-otx, /lookup-censys, /lookup-urlscan, /lookup-misp, /lookup-opencti, /lookup-reversinglabs, /lookup-crowdstrike, optionally /lookup-ransomwarelive, optionally /lookup-sentinel (exposure sweep of the confirmed-malicious subset against your own telemetry); then /score-source, /apply-tlp, /confidence-language. For deeper graph traversal, hands off to /indicator-pivoting.

Enrichment routing by IOC type

IPv4/IPv6 address

Domain

URL

File hash (MD5, SHA-1, SHA-256)

Email address

Enrichment process

Step 1: Parse and classify

Read the input IOC list. For each indicator:

1. Determine type (IPv4, IPv6, domain, URL, hash, email)
2. Validate format (regex check)
3. Deduplicate

Step 2: Batch and route

Group IOCs by type. For each group, dispatch the relevant /lookup-* skills (see routing tables above).

Parallelisation: For a single IOC, dispatch all relevant lookups in parallel. For bulk IOCs, process in batches of 10 to respect rate limits (see tools/REGISTRY.md for per-API limits).

Step 3: Synthesise results

For each IOC, combine results from all lookups into a single enrichment record:

indicator: 203.0.113.42
type: ipv4-addr
enrichment_date: 2026-04-04
source_assessment: F6  # Automated enrichment, no human judgment yet

virustotal:
  detection_ratio: 12/87
  community_score: -45
  associated_domains: [evil.example.com, bad.example.org]

abuseipdb:
  abuse_confidence: 95
  total_reports: 234
  isp: "Bulletproof Hosting Inc"
  country: RU

greynoise:
  classification: malicious
  noise: false
  tags: [c2, cobalt-strike]

shodan:
  ports: [80, 443, 8443]
  os: Linux
  vulns: [CVE-2024-12345]

otx:
  pulse_count: 7
  tags: [apt28, fancy-bear, c2]

censys:
  services: [HTTP, HTTPS]
  certificate_issuer: "Let's Encrypt"

misp:
  matched_attributes: 3
  matched_events: [42, 137]   # event IDs in the local instance
  prior_tags: ["tlp:amber", "actor:apt28"]

opencti:
  known_as: [observable, indicator]
  indicator_score: 85          # x_opencti_score on the existing indicator
  prior_labels: [apt28, c2]

synthesis:
  verdict: malicious
  confidence: 85
  context: "Known C2 server associated with APT28 campaigns. Hosted on bulletproof infrastructure in Russia. Multiple community reports plus prior MISP events confirm malicious activity."
  tags: [apt28, c2, cobalt-strike]
  mitre_attack: [T1071.001]

Step 4: Assess and tag

Apply source assessment (Admiralty Scale) to the enrichment with /score-source:

• Source reliability: B (established tool APIs, usually reliable)
• Information credibility: based on corroboration across tools (3+ tools agree → 1/Confirmed; 2 agree → 2/Probably true; single source → 3/Possibly true)
• A MISP or OpenCTI hit on a previously-curated event/entity lifts credibility one step (your team has already vetted it once)
• A Liberty91 hit brings its own Admiralty rating — use the occurrence's credibility band and each source's reliability grade verbatim instead of re-deriving them from tool agreement

Step 5: Store

Write enrichment results to data/iocs/active/YYYY-MM-DD-<context>.md with appropriate frontmatter. Apply /apply-tlp before sharing outside the team.

Step 6 (optional): Push back

If the enrichment confirms a previously-unknown malicious indicator, push it back into your own platform so future enrichments hit your catalogue first: /lookup-misp add-attribute (or create-event for a fresh cluster) for a MISP instance, /lookup-opencti create-indicator (with --score and --labels) for an OpenCTI knowledge base, and/or /lookup-liberty91 ingest to file the finding as a report in Liberty91 (it is enriched and matched into a Threat Event for your account). Liberty91 writes are metered and publish to your account — confirm with the user first.

Step 6b (optional): Sweep your own telemetry

If $SENTINEL_WORKSPACE_ID + app credentials are set, take the confirmed-malicious subset (not the whole raw list) and chain /lookup-sentinel for a batch exposure sweep — one let-bound dynamic list per IOC type, run only against tables that skill confirms exist in the workspace. This answers the question enrichment cannot: did any of these touch us? Hits become incident leads (route to the matching /*-investigation); a clean sweep is reported as "not observed in collected telemetry over ", never as "not compromised".

Step 7 (optional): Pivot

If the enrichment surfaces strong cluster candidates (cert siblings, JARM matches, communicating files), hand off to /indicator-pivoting for the next hop.

Rate-limit awareness

Per-API limits live in tools/REGISTRY.md. Summary:

Handling missing API keys

If an API key is not configured for a service:

1. Skip that enrichment source
2. Note in the synthesis that the source was unavailable
3. Adjust confidence accordingly (fewer sources = lower corroboration)
4. Continue with available sources

To configure missing keys, point the user at /cti-setup.

Related skills

• /lookup-liberty91, /lookup-virustotal, /lookup-abuseipdb, /lookup-greynoise, /lookup-shodan, /lookup-otx, /lookup-censys, /lookup-urlscan, /lookup-misp, /lookup-opencti, /lookup-reversinglabs, /lookup-crowdstrike, /lookup-ransomwarelive — the underlying lookups
• /lookup-sentinel — batch exposure sweep of confirmed-malicious IOCs against your own Sentinel workspace (step 6b)
• /ip-investigation, /domain-investigation, /hash-investigation, /url-investigation — single-seed first-hop chains; this workflow is the bulk-list equivalent
• /indicator-pivoting — when an enrichment opens new pivot candidates
• /score-source, /apply-tlp, /confidence-language — apply rigor to each finished enrichment record