Threat Intelligence (TI)
Threat Intelligence holds enrichment results for observables.
1) Open Threat Intelligence
- Navigate to Application Records -> Threat Intelligence.
- Search by observable value (IP, domain, URL, hash).
2) Core fields
- Observable: Observable, Observable Type, Observable File.
- Enrichment: Enrichments, Merged Risk Scores, Turbine Risk Score.
- Verdict: Threat Intelligence Verdict.
- Timing: First Created, Last Seen, Last Updated, TI Last Updated.
2a) Observable panel
- Review Observable and Observable Type.
- Use Observable File to attach or review file samples when available.
2b) Metrics panel
- Review First Created, Last Updated, Last Seen, and TI Last Updated to understand recency.
2c) Risk and enrichment panels
- Risk Score Widget summarizes Turbine Risk Score and related Risk Elements.
- Turbine Risk Score panel shows the current verdict and Merged Risk Scores.
- Raw Enrichments lists provider responses for troubleshooting and verification.
- Use Enrich Observable to re-run enrichment on demand.
2a) Validation steps
- Confirm the Observable Type matches the value (IP, domain, URL, hash).
- Compare multiple provider results in Enrichments.
- Use Turbine Risk Score to prioritize.
2b) Provider outcomes
- Results can be pending, complete, or error for a provider. Errors indicate missing credentials or unavailable providers.
- Unknown verdicts can still appear when providers return no definitive data.
- TI enrichment checks run on a short interval and retry a few times (about once per minute, up to five checks) before finalizing a result; if providers do not respond, the status can end as error.
Analyst tips
- Verify provider coverage in Enrichments.
- Use Merged Risk Scores to compare provider signals.
Commonly used fields
- Observable and Observable Type to confirm the target.
- Threat Intelligence Verdict and Turbine Risk Score to prioritize.
- Enrichments and Merged Risk Scores to compare providers.
- First Created, Last Seen, and TI Last Updated for recency.
Detailed workflow
- Open the observable from the Threat Intelligence panel on a signal.
- Verify Observable Type and confirm enrichment providers returned results.
- Review Enrichments for provider-specific verdicts and evidence.
- Use Turbine Risk Score and Threat Intelligence Verdict to decide next steps.
- If results are missing, check for error status and validate provider assets.