01
Report the action your control took
Add action_taken (block or allow) and, optionally, action_source (firewall, EDR, DNS filter, manual) to the indicator on POST /verdict or POST /verdict/bulk. Per item, opt-in, nothing else changes.
Portal · Blind Spot Analysis
Where your stack and the verdict disagree.
Tell us the action you took on the call you already make: one extra field, action_taken. The portal keeps score on every query where your block or allow and our verdict do not line up.
No new integrationNo log shippingNeutral categories, no blame
Representative product screen
Blind Spot Analysis
Agreement rate78%Your call and the verdict agree.
Coverage gap9%Allowed, verdict says malicious.
Over-block13%Blocked, verdict says not malicious.
Values are illustrative. Calculated only on queries where action_taken was sent; the portal shows your adoption rate.
HOW IT WORKS
One field on the call you already make.
No connector, no log pipeline, no second product to wire. The verdict call your SIEM, SOAR or firewall already sends carries the answer; you add what your control did with it.
02
We compare it with the verdict you got
The comparison uses the verdict returned on that query, at that time. No silent re-scoring, no second opinion later. The malicious threshold is shown on screen and you can move it to see the answer change.
03
The portal keeps score
Three KPI cards, a daily trend, and a drilldown per category. Every row opens to its evidence and action source; the gap list exports as CSV for the next coverage review.
THREE CATEGORIESAgreed. Coverage gap. Over-block.
Agreed. Coverage gap. Over-block.
Nobody is called wrong.
Every actioned query lands in exactly one of three neutral categories. We do not label your stack right or wrong; we show you where the two readings differ, with the signals behind ours, and let you decide.
Agreed
Your action matches the verdict. Block met malicious, allow met clean. Most traffic lands here, and the rate is the confidence number you can report upward.
Coverage gap
You allowed it. The verdict says malicious. This is the blind spot: traffic your controls let through that our signals flag. Each row carries the evidence, so you can review it before it becomes an incident.
Over-block
You blocked it. The verdict says not malicious. Legitimate traffic cut by a rule that is too wide. Each row shows why we read it as clean, so you can loosen the rule with evidence, not a guess.
CONTINUOUS, NOT ONE-SHOT
A replay is a photograph. This is the panel you check every week.
Bulk Replay scans a list you hand us once. Blind Spot Analysis reads the traffic you already ask about, continuously, and keeps the score current without a second upload.
Bulk Replay
“How did the list we acted on last month score today?”On demand, one batch, one report. Right for an audit, a PoC or a rule review.
Blind Spot Analysis
“Where did our controls and the verdict disagree this week?”Always on, per query, trended by day. Right for the SOC manager who wants the number every Monday.
Both read the same neutral categories. The difference is population: Blind Spot Analysis only sees queries where action_taken was sent, so its numbers reflect what you reported, not everything you blocked. The portal shows that adoption rate next to the score.
WHO READS IT
Three readers, one panel.
The same three numbers answer a different question depending on who opens the page.
For SOC managers
The part of the queue you cannot see from inside: what your controls let through this week, ranked by risk, each row opening to its evidence.
For CISOs
A coverage number you can put in a board slide, with the caveat spelled out. Export the gap list as CSV for the review, filter by action source to see which control leaks.
For security engineers
One extra field on an integration you already run. Move the threshold on screen to test a stricter bar before you change a single rule.
THE REQUEST
Same endpoint, two optional fields.
action_taken opts the request into the analysis; action_source lets you slice by control. Neither touches the verdict or the API response: they are logged next to it, never scored, never cached. The result is read in the portal, not returned by the call. Works per indicator on POST /verdict and POST /verdict/bulk alike.
Request · POST /verdict/bulk
curl -X POST https://api.verdictiq.io/api/v2/ioc/verdict/bulk \
-H "X-API-Key: $VERDICTIQ_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"indicators": [
{ "type": "domain", "value": "invoice-p•••••••.top",
"action_taken": "allow", "action_source": "firewall" },
{ "type": "domain", "value": "cdn-patch•••••••.net",
"action_taken": "block", "action_source": "dns_filter" },
{ "type": "domain", "value": "hr-benef••••••.com",
"action_taken": "block", "action_source": "edr" }
]
}'What the portal shows
Blind Spot AnalysisThreshold 51+
invoice-p•••••••[.]top92 · CriticalallowedfirewallCoverage gap
cdn-patch•••••••[.]net78 · High Riskblockeddns_filterAgreed
hr-benef••••••[.]com12 · CleanblockededrOver-block
Send the action your control already took, independent of this query. If you block only because we said so, the panel is reading its own echo; the value is in decisions your stack made on its own.
Find the blind spot before the incident does.
Add one field to the call you already make. Open the panel next week and read the number.
GDPR alignedLLM-free by defaultOwn infrastructureOpt-in per request
See our security posture →