Bulk IOC enrichment for active incident response

The first hour of an incident is tab-management

The endpoints that solve it

The canonical IR enrichment loop

# Hour 1 — enrich every IOC from EDR export + firewall logs
curl https://api.dfir-lab.ch/v1/enrichment/lookup \
  -H "Authorization: Bearer $DFIR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "indicators": [
      { "type": "ip",     "value": "45.155.205.233" },
      { "type": "ip",     "value": "193.29.13.211" },
      { "type": "domain", "value": "rclone-update.top" },
      { "type": "url",    "value": "https://mega.nz/file/abc123" },
      { "type": "hash",   "value": "e4a1b8c9...sha256" }
    ]
  }'

# Response: one object per IOC with aggregated verdict,
#           per-source detail, and confidence score.

# Hour 2 — turn the enrichment into a sit-rep paragraph
curl https://api.dfir-lab.ch/v1/ai/triage \
  -H "Authorization: Bearer $DFIR_API_KEY" \
  -H "Content-Type: application/json" \
  -d @enrichment-response.json

# Optional: profile the apparent actor for the exec brief
curl https://api.dfir-lab.ch/v1/ai/threat-profile \
  -H "Authorization: Bearer $DFIR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "ttps": ["T1486", "T1490", "T1562.001"],
    "context": "Ransomware on a Windows fileserver, LOLBin-heavy, SMB lateral movement observed."
  }'

1. 01
   Step 01

   Collect

   Pull the IOC set together — EDR export, firewall logs, host triage output, client-provided indicators. No strict format required; the endpoint accepts IPs, domains, URLs, and hashes in one batch.

2. 02
   Step 02

   Enrich

   POST the combined indicators[] array to /v1/enrichment/lookup. The response returns one normalized verdict per IOC, aggregated across every applicable source.

3. 03
   Step 03

   Prioritize

   Sort the response by aggregate verdict and confidence. The top-of-list indicators are where the IR lead spends the next hour; the bottom-of-list are noise that can be archived without follow-up.

4. 04
   Step 04

   Narrate

   For the client sit-rep, feed the enrichment JSON into /v1/ai/triage to generate a paragraph, and /v1/ai/threat-profile if an actor has been named. Both drop into the written update without hand-curation.

5. 05
   Step 05

   Hand off

   Export the normalized enrichment alongside the case notes. The same JSON feeds directly into TheHive, DFIR-IRIS, or a flat case-file repo — no schema translation layer needed.

Pricing that tracks your workload

1. 01

   Solo consultant — 2 engagements/mo × 100 IOCs each

   (2 × 100 × 3) + (2 × 10) = 600 + 20 = 620 credits/month

   Exceeds Starter (500) slightly — Starter ($29) + a one-shot 250-credit top-up covers it, or step up to Professional ($99, 2,500 credits) for headroom.
2. 02

   Small IR firm — 5 engagements/mo × 200 IOCs + AI narrative

   (5 × 200 × 3) + (5 × 10) + (5 × 20) = 3,000 + 50 + 100 = 3,150 credits/month

   Exceeds Professional (2,500) — Professional + a 1,000-credit top-up, or move to Enterprise for unlimited usage.
3. 03

   DFIR practice — 15 engagements/mo × 300 IOCs

   (15 × 300 × 3) + (15 × 10) + (15 × 20) = 13,500 + 150 + 300 = 13,950 credits/month

   Enterprise tier (custom pricing, unlimited credits) is the only sensible fit at this volume.

Three ways to evaluate

Frequently asked

Q / 01

What is the maximum batch size for /v1/enrichment/lookup?

Practical batches run into the hundreds of indicators per request. For a 500-IOC dump, most engagements split the batch into 2–5 calls to keep latency under 30 seconds per request; the endpoint itself does not hard-cap at a small number.

Q / 02

Which sources actually run per IOC type?

IPs fan out to up to 11 sources (VirusTotal, AbuseIPDB, GreyNoise, Shodan, Censys, OTX, urlscan, Pulsedive, ThreatFox, IPVoid, Hybrid Analysis). Domains and URLs run 8 sources. Hashes run 6 sources. The exact source count per response depends on which providers returned data in time; the response includes a sources_consulted field you can inspect.

Q / 03

How does the normalized verdict work?

Each source returns its raw response, but the platform also computes an aggregated verdict (clean / suspicious / malicious) and a confidence score based on source agreement and historical accuracy. You get both — the normalized top-level verdict for fast triage and the raw per-source JSON for forensic defensibility.

Q / 04

Can I feed this into TheHive / DFIR-IRIS / Splunk?

Yes. The response JSON is stable and designed to map cleanly to case-management schemas. There is a separate use case on Splunk integration, and the TheHive analyzer pattern is documented — both use the same /v1/enrichment/lookup endpoint under the hood.

Q / 05

What is the retention policy for the IOCs I submit?

Submitted indicators are stored under your org for audit and re-query. If a client contract requires no retention, that is configurable per API key on Professional and Enterprise plans — get in touch to set it up.

Q / 06

Does this replace a dedicated TI platform like ThreatConnect or Anomali?

No — those are curation and collaboration platforms. DFIR Platform is the enrichment layer, not the intel-management layer. Most IR consultants use it for fast per-engagement enrichment and keep their case records in the tool of their choice.