---
title: Configure Threat Intelligence Enrichment Integration
slug: solutions/configure-threat-intelligence-enrichment-integration
docTags: 
createdAt: 2025-08-11T11:13:45.686Z
---

## Configure Threat Intelligence Enrichment Integration

Threat Intelligence Enrichment gathers reputation information from observables, such as IP addresses, domains, URLs, hashes, email addresses, and so on from one or more enrichment providers using enrichment components. Results are aggregated in Threat Intelligence records, and displayed in Case and Incident Management records as well. Every observable type has a Primary Integlligence Provider (PIP) which is the canonical source of truth for reputation verdict, permalinks, and so on for that observable type.

## Prerequisites

Before configuring Threat Intelligence Enrichment:

- Ensure you have access to the SOC Solutions Bundle playbooks
- Have enrichment provider credentials and assets configured
- Understand which observables you want to enrich (IPs, domains, URLs, hashes, etc.)

## Configuration Steps

### Step 1: Navigate to Components

1. Navigate to **Orchestration** in the Swimlane platform.
2. Click on **Components**.
3. Locate and open the **SOC - Enrich Observables** component (or **SOC - Enrich Observable** depending on your version).

### Step 2: Configure Enrichment Sources

The component uses a Parallel node to run multiple enrichment sources simultaneously. You need to configure which enrichment sources to use:

::Image[]{src="https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/VsK2AAoFEgiicQJ1BNqTM_install-and-configure-soc11.png" size="100" isUploading="false" initialPath="../../Resources/Images/Install and Configure SOC Solutions for Canvas/Install and Configure SOC_11.png" githubPath="Turbine_User_Guide/Content/Resources/Images/Install and Configure SOC Solutions for Canvas/Install and Configure SOC_11.png" width="800" height="705" darkWidth="1275" darkHeight="1125" showCaption="false" indent="4"}

### 2.1: Remove Unused Enrichment Sources

1. Open the **SOC - Enrich Observables** component.
2. Navigate to the **Parallel** node in the component workflow.
3. Review the existing enrichment sources listed under the Parallel node.
4. Remove any enrichment sources you are not using:
   - Click on the enrichment source component
   - Delete or remove it from the Parallel node
   - This helps reduce unnecessary API calls and improves performance

### 2.2: Add New Enrichment Sources

1. Click **Edit** on the Parallel node (or add a new component to the Parallel node).
2. From the **Components** menu, select the enrichment source component you want to add (e.g., VirusTotal, Recorded Future, URLHaus, etc.).
3. For each new enrichment source component you add:
   - Click **Edit** on the enrichment source component
   - Navigate to the **Inputs** configuration
   - Map `inputs.observable` as a playbook property:
     - In the input mapping, select "Playbook Property"
     - Navigate to or search for `inputs.observable`
     - This ensures the observable data flows from the playbook into the enrichment component
   - Configure any other required inputs (API keys, authentication, etc.) using the component's asset configuration

**Note:** The `inputs.observable` property contains the observable object that needs to be enriched. It typically includes:

- `observable_type`: The type of observable (e.g., "ip", "domain", "url", "hash")
- `observable_value`: The actual value to enrich (e.g., "192.168.1.1", "example.com")
- `observable_metadata`: Any additional metadata about the observable

### Step 3: Configure Aggregate Enrichments Action

After removing or adding new enrichment sources, you must update the **Aggregate Enrichments** action to reflect your changes:

1. Locate the **Aggregate Enrichments** action in the component workflow (typically after the Parallel node).
2. Click **Edit** on the Aggregate Enrichments action.
3. Review the existing append actions:
   - Each enrichment source component should have its **Enrichments** property mapped to an append action
   - The append actions combine enrichment results from all sources into a single aggregated result
4. For each enrichment source you added:
   - Add a new append action
   - Map the enrichment source component's **Enrichments** output property to the append action
   - Ensure the target is the aggregated enrichments object (not `$DELETED`)
5. For each enrichment source you removed:
   - **Remove** any append actions whose target is `$DELETED`
   - Remove append actions that reference deleted enrichment sources
   - **Important:** Any append action whose target is `$DELETED` must be removed to prevent errors

::Image[]{src="https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/pcJctoCchlUIK4zatri-H_install-and-configure-soc12.png" size="84" width="1794" height="588" darkWidth="1794" darkHeight="588" position="center" showCaption="false" indent="3"}

**Example Aggregate Enrichments Configuration:**

If you have three enrichment sources (VirusTotal, Recorded Future, URLHaus), your Aggregate Enrichments action should have three append actions:

- Append VirusTotal enrichments → aggregated enrichments
- Append Recorded Future enrichments → aggregated enrichments
- Append URLHaus enrichments → aggregated enrichments

### Step 4: Configure Enrichment Assets

Ensure that your enrichment provider assets are properly configured:

1. Navigate to **Orchestration** → **Assets**.
2. For each enrichment provider you're using:
   - Locate or create the asset for that provider
   - Configure authentication credentials (API keys, tokens, etc.)
   - Set up any required connection parameters
   - Test the asset connection to ensure it's working correctly
3. Verify that the asset names match what's configured in your enrichment source components

**Common Enrichment Providers:**

- VirusTotal
- Recorded Future
- URLHaus
- AbuseIPDB
- Shodan
- And others based on your subscription

## Verification

After configuration, verify your setup:

1. **Test the Component:**
   - Run a test playbook execution with a sample observable
   - Verify that enrichments are being retrieved from all configured sources
   - Check that the Aggregate Enrichments action is combining results correctly
2. **Check Output:**
   - Verify that enrichment results appear in Threat Intelligence records
   - Confirm that enrichments are displayed in Case and Incident Management records
   - Ensure the Primary Intelligence Provider (PIP) is correctly identified
3. **Monitor Performance:**
   - Check execution times to ensure parallel enrichment is working efficiently
   - Monitor API rate limits if applicable
   - Review error logs for any failed enrichment requests

## Troubleshooting

### Issue: Enrichments Not Appearing

**Possible Causes:**

- Enrichment assets are not properly configured
- API credentials are invalid or expired
- Enrichment source components are not receiving observable input

**Solutions:**

- Verify asset configuration and test connections
- Check API credentials and renew if necessary
- Verify that `inputs.observable` is correctly mapped in enrichment source components

### Issue: Aggregate Enrichments Errors

**Possible Causes:**

- Append actions reference deleted enrichment sources
- Append actions have `$DELETED` as target
- Missing append actions for new enrichment sources

**Solutions:**

- Remove any append actions with `$DELETED` targets
- Add append actions for all active enrichment sources
- Verify that each enrichment source's Enrichments output is mapped correctly

### Issue: Performance Issues

**Possible Causes:**

- Too many enrichment sources running in parallel
- API rate limiting from enrichment providers
- Network latency issues

**Solutions:**

- Consider reducing the number of enrichment sources
- Implement rate limiting or caching
- Check network connectivity to enrichment providers

## Best Practices

1. **Selective Enrichment:** Only use enrichment sources that provide value for your specific observable types
2. **Asset Management:** Keep enrichment provider assets up to date with valid credentials
3. **Error Handling:** Configure proper error handling for failed enrichment requests
4. **Performance:** Monitor and optimize the number of parallel enrichment sources
5. **Cost Management:** Be aware of API usage limits and costs for enrichment providers

## Related Documentation

- [SOC Solutions Bundle](docId\:GofETK5tNxwTx8IYFbFev)
- [Turbine Solutions Interfaces](docId\:zYBqDpKxWzV8BV4SCsMTe)