---
title: Configure Threat Intelligence Enrichment
slug: solutions/configure-threat-intelligence-enrichment
docTags: 
createdAt: 2026-03-04T10:42:19.060Z
---

Threat intelligence enrichment is handled by the **AI SOC - Enrich Observables** component, which is used in various playbooks throughout the solution.

### How Enrichment Works

The **AI SOC - Enrich Observables** component:

- Automatically enriches observables when signals are created
- Uses the TI providers configured in the **AI SOC Threat Intelligence Configuration** asset
- Respects the ignore lists and observable type filters you configured
- Aggregates results from multiple providers based on configured weights

### Configure Enrichment Components

The enrichment component uses individual provider components for each TI source:

- **Enrich - VirusTotal Enrich Observable (VIC)**
- **Enrich - Recorded Future Enrich Observable (VIC)**
- **Enrich - AbuseIPDB Enrich Observable (VIC)**
- **Enrich - URLHaus Enrich Observables (VIC)**
- **Enrich - IPQualityScore Enrich Observable (VIC)**
- **Enrich - URLScan Enrich Observable (VIC)**

:::hint{type="info"}
These components are already configured in the **AI SOC - Enrich Observables** component. You typically do not need to modify them unless you are adding custom providers.
:::

### Provider Configuration

1. Ensure each TI provider asset is configured with valid API keys/credentials
2. Verify provider names in the **AI SOC Threat Intelligence Configuration** asset match the component names exactly
3. Adjust provider weights if you want to prioritize certain sources

### Configure URLScan

AI SOC 26.2.0 adds URLScan as a threat intelligence provider for URL and domain observables.

1. Open the **URLScan** asset.
2. Verify the URL is [https://urlscan.io](https://urlscan.io).
3. Enter your URLScan **API-Key**. Configure **verify\_ssl** and **http\_proxy** if required for your environment.
4. Save and activate the asset.
5. Open the **AI SOC Threat Intelligence Configuration** asset and verify that **URLScan** appears under **Threat Intelligence Providers**. Adjust its weight if required.

The **Enrich - URLScan Enrich Observable (VIC)** component supports only **url** and **domain** observable types. Do not use it for IPv4, IPv6, MD5, SHA-1, SHA-256, or other observable types. URLScan returns normalized enrichment data for downstream verdict calculation rather than storing the complete raw scan response on the Threat Intelligence record.

### Test Enrichment

1. Create a test signal with observables (IP, domain, URL, or hash)
2. Verify enrichment runs automatically (check the signal's **Threat Intelligence Reference** field)
3. Open the **Threat Intelligence** application to view detailed enrichment results
4. Verify aggregated verdicts and risk scores are calculated correctly based on your thresholds