Triage suspicious addresses and file hashes.
What it does
Assesses suspicious network and file indicators to provide confidence scores, campaign context, and blocking recommendations.
When to use it
Use for rapid triage of indicators from phishing or alerts, scoring bulk threat feeds, or enriching artifacts during an incident investigation.
How to use it
Give it suspicious indicators; it enriches and scores them, records findings and disposition rationale in TIP/MISP, and exports a STIX indicator.
What you provide
- IP addresses, domains, or file hashes
Uses
What you need · 10
Requires a MISP instance or another threat intelligence platform for cross-referencing known campaigns and recording findings.
The documented Python workflow requires Python; a SOAR platform with pre-built connectors is offered as an alternative.
Access · 6
This skill
TIP/MISP
Records findings in TIP/MISP
VirusTotal
Looks up VirusTotal threat intelligence