It isn't a one-and-done report. It's your own analyst on call: talk to it in plain language, ask follow-ups, and go deeper signal by signal until the picture is clear. The deterministic verdict ships either way; this conversation lives in the portal, on top of it.
A static write-up explains the score once and stops. Real triage is the second and third question, the follow-up the paragraph didn't cover. With no one to ask, the IOC sits in the queue or rides on a guess.
Every verdict already ships with the signals, the score and the recommended action. Enrich with AI turns those signals into a paragraph your most junior analyst can act on without escalating.
Turns the score, signals and recommended action into a plain-language read your most junior analyst can act on.
Ask why it scored, what a signal means, or what to do next, in plain language, and go deeper one question at a time.
Talk to it like a senior colleague. Ask whatever is on your mind and get a precise, evidence-backed answer, deepening one turn at a time.
Open an IOC in the VerdictIQ portal, then click Enrich with AI in the Analysis sidebar. The AI layer reads only what the deterministic engine just produced and renders the narrative alongside the same verdict.
Inside the portal, the left nav has an Analysis section with three actions: IOC Enrichment, Bulk IOC Enrichment, and Enrich with AI. Pick the IOC and click Enrich with AI.
The AI layer reads the signals and evidence the deterministic engine just produced. No external lookup, no internet pull, no memory of prior verdicts.
A short narrative arrives alongside the verdict in the portal pane. Score, risk level and recommended action don't move; the narrative is added on top.
Skip Enrich with AI and the deterministic verdict still ships: through the API, through IOC Enrichment in the portal, or through Bulk IOC Enrichment. The AI layer only runs when you click the action.
Tier 1 closes the ticket without a senior tap. MSSP analysts speak the same language across tenants. CTI triages at first sight. Detection engineers turn a verdict into a hunt hypothesis.
Enrich with AI explains the verdict in plain language, so a tier-1 analyst sees why it scored high and acts on it, block or escalate, without waiting on a senior tap.
Every tenant gets the same senior-level write-up from the same signals, so the rationale reads consistently across analysts and shifts, with no drift as you add tenants.
The narrative tells you why an IOC matters and which relational signals tie it to known infrastructure, so you triage before committing a full investigation.
The write-up spells out which behavioral signals fired and why, so an engineer turns a single verdict into a detection rule or a hunt hypothesis instead of reverse-engineering a score.
Enrich with AI has a single, narrow job: turn a deterministic verdict into a portal-pane paragraph an analyst can act on. Anything beyond that lives on a different surface.
No narrative key, no explain flag, no SDK call. Your SIEM and SOAR see the deterministic verdict only.
A deterministic signal engine computes the verdict before the model writes a word. Take the engine away and there is nothing to narrate.
It reads only the verdict just produced. No live web pull, no third-party call.
The write-up is bound to the exact signals and evidence of this verdict. It can only restate what the engine proved, never invent a reason that didn't fire.
Grounded in VerdictIQ's own signal taxonomy, not a stock model guessing about IOCs. Every line traces back to a named signal.
VerdictIQ AI reasons like a senior analyst and runs on fresh data every call: live DNS, WHOIS, relational and behavioral signals, not a cached summary. You get a read that reflects the infrastructure as it stands right now, explained in plain language.
No. Enrich with AI renders one narrative per IOC in the portal pane next to the verdict. There is no conversation thread, no follow-up turn, no context retained between IOCs.
Both, in a way. Every plan, free tier included, comes with a monthly allowance of AI tokens at no extra cost. If you run through it, you can buy more tokens to keep going. There is no per-IOC surcharge and no separate subscription, you only pay if you need more than the included allowance.
No. The score, risk level and recommended action are functions of the signals, not the model. Enrich with AI adds a portal narrative; it does not adjust the deterministic output.
The verdict path is fully LLM-free: the score, signals and recommended action come from deterministic fusion, with no model in the loop. The Enrich with AI narrative is the one part that uses an LLM, and that is what your AI token allowance covers. It only runs when an analyst clicks Enrich with AI in the portal, so you spend tokens just on the verdicts you choose to explain.
No. The narrative is portal-only. API and SDK clients always receive the deterministic verdict, no narrative field, no explain flag.
An internally-managed LLM, not a public third-party API. Sub-processors and model provenance are disclosed at /trust.
No. The AI layer is stateless. Inputs are not retained for model training; sub-processor contracts forbid training on customer data.
The AI layer reads only the structured signals and evidence the deterministic engine produced. Raw IOC strings are not concatenated into the prompt as free-form text.
The deterministic verdict ships unchanged through the API and the portal. The portal narrative simply doesn't appear that round; the score, risk level and recommended action remain identical.
The narrative is plain text for analyst consumption. The structured fields (risk_level, recommended_action, signals[]) are designed for SIEM ingestion. Every signal maps to MITRE ATT&CK techniques.
No. The narrative cites what already fired, not what it imagined. Every sentence is anchored to a signal or evidence the deterministic engine already produced for that IOC, with no external lookup and no internet pull. If a signal didn't fire, the write-up doesn't mention it; nothing is invented to fill a gap.
Sign in to the VerdictIQ portal and run Enrich with AI on any IOC. The deterministic verdict ships either way; the senior-analyst read appears in the pane next to it. Free tier, no credit card.