---
title: Threat Intelligence (TI)
slug: solutions/threat-intelligence-ti
docTags: 
createdAt: 2026-03-04T10:36:44.601Z
---

**Threat Intelligence** holds enrichment results for observables.

1\) Open **Threat Intelligence**

- Navigate to **Application Records** -> **Threat Intelligence**.
- Search by observable value (IP, domain, URL, hash).

2\) Core fields

- **Observable**: **Observable**, **Observable Type**, **Observable File**.
- Enrichment: Enrichments, **Merged Risk Scores**, **Turbine Risk Score**.
- Verdict: **Threat Intelligence** Verdict.
- Timing: First Created, Last Seen, Last Updated, TI Last Updated.

2a) **Observable** panel

- **Review** **Observable** and **Observable Type**.
- Use **Observable File** to attach or review file samples when available.

2b) **Metrics** panel

- **Review** First Created, Last Updated, Last Seen, and TI Last Updated to understand recency.

2c) Risk and enrichment panels

- Risk Score Widget summarizes **Turbine Risk Score** and related Risk Elements.
- **Turbine Risk Score** panel shows the current verdict and **Merged Risk Scores**.
- **Raw Enrichments** lists provider responses for troubleshooting and verification.
- Use **Enrich Observable** to re-run enrichment on demand.

2a) Validation steps

- Confirm the **Observable Type** matches the value (IP, domain, URL, hash).
- Compare multiple provider results in Enrichments.
- Use **Turbine Risk Score** to prioritize.

2b) Provider outcomes

- Results can be pending, complete, or error for a provider. Errors indicate missing credentials or unavailable providers.
- Unknown verdicts can still appear when providers return no definitive data.
- TI enrichment checks run on a short interval and retry a few times (about once per minute, up to five checks) before finalizing a result; if providers do not respond, the status can end as error.

Analyst tips

- Verify provider coverage in Enrichments.
- Use **Merged Risk Scores** to compare provider signals.

Commonly used fields

- **Observable** and **Observable Type** to confirm the target.
- **Threat Intelligence** Verdict and **Turbine Risk Score** to prioritize.
- Enrichments and **Merged Risk Scores** to compare providers.
- First Created, Last Seen, and TI Last Updated for recency.

Detailed workflow

1. Open the observable from the **Threat Intelligence** panel on a signal.
2. Verify **Observable Type** and confirm enrichment providers returned results.
3. **Review** Enrichments for provider-specific verdicts and evidence.
4. Use **Turbine Risk Score** and **Threat Intelligence** Verdict to decide next steps.
5. If results are missing, check for error status and validate provider assets.