automating-ioc-enrichment

# Automating IOC Enrichment ## When to Use Use this skill when: - Building a SOAR playbook that automatically enriches SIEM alerts with threat intelligence context before routing to analysts - Creating a Python pipeline for bulk IOC enrichment from phishing email submissions - Reducing analyst mean time to triage (MTTT) by pre-populating alert context with VT, Shodan, and MISP data **Do not use** this skill for fully automated blocking decisions without human review — enrichment automation should inform decisions, not execute blocks autonomously for high-impact actions. ## Prerequisites - SOAR platform (Cortex XSOAR, Splunk SOAR, Tines, or n8n) or Python 3.9+ environment - API keys: VirusTotal, AbuseIPDB, Shodan, and at minimum one TIP (MISP or OpenCTI) - SIEM integration endpoint for alert consumption - Rate limit budgets documented per API (VT: 4/min free, 500/min enterprise) ## Workflow ### Step 1: Design Enrichment Pipeline Architecture Define the enrichment flow for each IOC type: ``` SIEM Alert → Extract IOCs → Classify Type → Route to enrichment functions IP Address → AbuseIPDB + Shodan + VirusTotal IP + MISP Domain → VirusTotal Domain + PassiveTotal + Shodan + MISP URL → URLScan.io + VirusTotal URL + Google Safe Browse File Hash → VirusTotal Files + MalwareBazaar + MISP → Aggregate results → Calculate confidence score → Update alert → Notify analyst ``` ### Step 2: Implement Python Enrichment Functions ```python import requests import time from datac...