IOC Enrichment Engine

Indicator lookup

Paste an IP, domain, URL, file hash, or email. The platform classifies it, queries reputation sources, attributes activity, and asks the Co-Analyst Engine for a briefing.

Indicator

Samples

Sources consulted

· ip-api.com — IP geolocation + ASN (free, always on)
· RDAP — domain registrar + age (free, always on)
· VirusTotal · AbuseIPDB · AlienVault OTX — when keys are set in Settings
· SARA — verdict + AI briefing (when configured)

Every field is pulled live from the sources above — no synthetic data. With no keys you still get real geo + WHOIS; add VirusTotal / AbuseIPDB / OTX keys for a high-confidence reputation verdict.

◇

Enter an indicator

Paste any IOC. The platform auto-detects the type and runs enrichment across all configured feeds.

SOC Overview