Automating IOC Enrichment

When to Use

Use this skill when:

• Building a SOAR playbook that automatically enriches SIEM alerts with threat intelligence context before routing to analysts
• Creating a Python pipeline for bulk IOC enrichment from phishing email submissions
• Reducing analyst mean time to triage (MTTT) by pre-populating alert context with VT, Shodan, and MISP data

Do not use this skill for fully automated blocking decisions without human review — enrichment automation should inform decisions, not execute blocks autonomously for high-impact actions.

Prerequisites

• SOAR platform (Cortex XSOAR, Splunk SOAR, Tines, or n8n) or Python 3.9+ environment
• API keys: VirusTotal, AbuseIPDB, Shodan, and at minimum one TIP (MISP or OpenCTI)
• SIEM integration endpoint for alert consumption
• Rate limit budgets documented per API (VT: 4/min free, 500/min enterprise)

Workflow