performing-ioc-enrichment-automation

# Performing IOC Enrichment Automation ## When to Use Use this skill when: - SOC analysts need to quickly enrich IOCs from multiple sources during alert triage - High alert volumes require automated enrichment to reduce manual lookup time - Incident investigations need comprehensive IOC context for scope assessment - SOAR playbooks require enrichment actions as part of automated triage workflows **Do not use** for bulk blocking decisions without analyst review — enrichment provides context, not definitive malicious/benign determination. ## Prerequisites - API keys: VirusTotal (free or premium), AbuseIPDB, Shodan, URLScan.io, GreyNoise - Python 3.8+ with `requests`, `vt-py`, `shodan` libraries - MISP instance or TIP for cross-referencing organizational intelligence - SOAR platform (optional) for workflow integration - Rate limit awareness: VT free (4 req/min), AbuseIPDB (1000/day), Shodan (1 req/sec) ## Workflow ### Step 1: Build Unified Enrichment Engine Create a multi-source enrichment pipeline: ```python import requests import vt import shodan import time from dataclasses import dataclass, field from typing import Optional @dataclass class EnrichmentResult: ioc_value: str ioc_type: str virustotal: dict = field(default_factory=dict) abuseipdb: dict = field(default_factory=dict) shodan_data: dict = field(default_factory=dict) greynoise: dict = field(default_factory=dict) urlscan: dict = field(default_factory=dict) misp_matches: list =...