Performing IOC Enrichment Automation

When to Use

Use this skill when:

• SOC analysts need to quickly enrich IOCs from multiple sources during alert triage
• High alert volumes require automated enrichment to reduce manual lookup time
• Incident investigations need comprehensive IOC context for scope assessment
• SOAR playbooks require enrichment actions as part of automated triage workflows

Do not use for bulk blocking decisions without analyst review — enrichment provides context, not definitive malicious/benign determination.

Prerequisites

• API keys: VirusTotal (free or premium), AbuseIPDB, Shodan, URLScan.io, GreyNoise
• Python 3.8+ with requests, vt-py, shodan libraries
• MISP instance or TIP for cross-referencing organizational intelligence
• SOAR platform (optional) for workflow integration
• Rate limit awareness: VT free (4 req/min), AbuseIPDB (1000/day), Shodan (1 req/sec)

Workflow

Step 1: Build Unified Enrichment Engine

Create a multi-source enrichment pipeline:

import requests
import vt
import shodan
import time
from dataclasses import dataclass, field
from typing import Optional

@dataclass
class EnrichmentResult:
    ioc_valu…