Configure Threat Intelligence Enrichment
Threat intelligence enrichment is handled by the AI SOC - Enrich Observables component, which is used in various playbooks throughout the solution.
How Enrichment Works
The AI SOC - Enrich Observables component:
- Automatically enriches observables when signals are created
- Uses the TI providers configured in the AI SOC Threat Intelligence Configuration asset
- Respects the ignore lists and observable type filters you configured
- Aggregates results from multiple providers based on configured weights
Configure Enrichment Components
The enrichment component uses individual provider components for each TI source:
- Enrich - VirusTotal Enrich Observable (VIC)
- Enrich - Recorded Future Enrich Observable (VIC)
- Enrich - AbuseIPDB Enrich Observable (VIC)
- Enrich - URLHaus Enrich Observables (VIC)
- Enrich - IPQualityScore Enrich Observable (VIC)
- Enrich - URLScan Enrich Observable (VIC)
These components are already configured in the AI SOC - Enrich Observables component. You typically do not need to modify them unless you are adding custom providers.
Provider Configuration
- Ensure each TI provider asset is configured with valid API keys/credentials
- Verify provider names in the AI SOC Threat Intelligence Configuration asset match the component names exactly
- Adjust provider weights if you want to prioritize certain sources
Configure URLScan
AI SOC 26.2.0 adds URLScan as a threat intelligence provider for URL and domain observables.
- Open the URLScan asset.
- Verify the URL is https://urlscan.io.
- Enter your URLScan API-Key. Configure verify_ssl and http_proxy if required for your environment.
- Save and activate the asset.
- Open the AI SOC Threat Intelligence Configuration asset and verify that URLScan appears under Threat Intelligence Providers. Adjust its weight if required.
The Enrich - URLScan Enrich Observable (VIC) component supports only url and domain observable types. Do not use it for IPv4, IPv6, MD5, SHA-1, SHA-256, or other observable types. URLScan returns normalized enrichment data for downstream verdict calculation rather than storing the complete raw scan response on the Threat Intelligence record.
Test Enrichment
- Create a test signal with observables (IP, domain, URL, or hash)
- Verify enrichment runs automatically (check the signal's Threat Intelligence Reference field)
- Open the Threat Intelligence application to view detailed enrichment results
- Verify aggregated verdicts and risk scores are calculated correctly based on your thresholds