Indicator enrichment
Query IPs, domains and URLs against the intelligence store and upstream sources.
Solutions
SOC Teams External context for tools your SOC already uses
Look up the IPs, domains, URLs and hashes in an alert. Every score shows the sources behind it.
No credit card required · Free API key
By the numbers
Inspect the threat corpus
Current indicator counts from the store the API queries.
Current data sample
public samplepublic sample
29 986 142
Total threats
20 416 459
Malicious domains
9 569 683
Malicious IPs
591
Sources in the corpus
By the numbersUpdated Oct 17, 03:33 UTC · Counters read at 2026-10-17T06:24:17.983Z. Indicator dates vary by source.public sample
Open a free threat report
No credit card required · Free: a 10% sample of each list · full lists on paid plans
Capabilities
Key features at a glance.
Scores with their sources
Each score lists the sources behind it, so analysts can weigh it against the alert.
One report per query
Reputation, DNS and registration context on one page, when available.
Corpus overview
See indexed categories and volumes before you choose an integration.
API integration
Structured JSON returned to the tools your analysts already use.
Applications
Use cases to evaluate first.
Alert triage
Compare the returned context with the evidence in a live alert.
Feed overlap
Check overlap with your current sources and which indicators are new.
Incident investigation
Keep each indicator’s sources and dates with the analyst’s findings.
In depth
Worth knowing before you start.
Test it on one real investigation
Take an anonymized alert, query its indicator and keep the exact response. Note what the API added that your sources lacked, and whether it changed the decision.
FAQ
Frequently asked questions.
Why use it alongside our existing tools and CERT feeds?
Only if it adds indicators or context you lack, or saves analyst time. Test that on real alerts. An unknown or low score is never a reason to close an alert automatically.
How can we use the data in our tools?
The REST API for single lookups, STIX/TAXII 2.1 for scheduled feed reads. Feed access requires Pro or Enterprise.
How fresh is the returned data?
It depends on each source’s ingestion schedule. Results carry source dates where available; your polling interval says nothing about the age of the intelligence.
What should we evaluate before adding a feed?
Pick the relevant collections, a representative sample and a success criterion. Then compare coverage and maintenance effort with your current sources.
Research
Related articles from the research blog.
Blog post
Investigate an IOC Alert: Link IP, DNS and Process Logs
An IOC match is an investigation lead. Correlate DNS, network connections and process records to establish what happened on the endpoint.
Read more
Blog post
Building a Modern SOC with Threat Intelligence: A Practical Guide
Learn how to build an effective Security Operations Center (SOC) powered by threat intelligence. Discover essential tools, processes, and best practices for detecting, analyzing, and responding to cyber threats in real-time.
Read more
Blog post
SOC Alert Fatigue: How Threat Intelligence Reduces False Positives Without Hiding Real Attacks
Alert fatigue is not a staffing problem alone. SOC teams need better evidence, source quality, confidence bands, and enrichment workflows that turn noisy alerts into defensible decisions.
Read moreTest it with your own indicators.
The free plan includes 50 lookups a month. Check the sources and limits, then connect the API.
No credit card required · Free API key