IOC Enrichment
IOC enrichment augments a bare indicator — an IP, domain, or hash — with context such as risk score, confidence, categories, WHOIS, DNS, geolocation, and related infrastructure. Enrichment turns block/allow decisions into informed analyst and automation workflows.
Frequently asked questions
What is IOC Enrichment?
IOC enrichment augments a bare indicator — an IP, domain, or hash — with context such as risk score, confidence, categories, WHOIS, DNS, geolocation, and related infrastructure. Enrichment turns block/allow decisions into informed analyst and automation workflows.
How is IOC Enrichment related to IOC (Indicator of Compromise)?
IOC (Indicator of Compromise) in short: An indicator of compromise is an indicator supported by evidence of compromise or malicious activity. Security teams use IOCs to detect, contain, and investigate threats; an arbitrary IP address, domain, URL, file hash, or email address is only an observable until evidence supports that promotion.
Related terms
IOC (Indicator of Compromise)
An indicator of compromise is an indicator supported by evidence of compromise or malicious activity. Security teams use IOCs to detect, contain, and investigate threats; an arbitrary IP address, domain, URL, file hash, or email address is only an observable until evidence supports that promotion.
Confidence Score
A confidence score quantifies how certain a threat intelligence system is that an indicator is malicious, given the evidence. isMalicious weights source signals by reliability, compares agreement and conflicts, and applies time decay to older observations.
Bulk API
A bulk API endpoint accepts multiple indicators in a single request, enabling high-throughput threat intelligence lookups without the latency overhead of individual calls. isMalicious accepts up to 500 mixed IP, domain, and URL indicators per request depending on the plan (10 on Free, 100 on Pro, 500 on Enterprise).
Try it on a real indicator
Look up any IP, domain, URL or file hash in the indexed records.