Triage at first sight.Score the whole neighborhood.
The IOC is scored the moment it lands. The verdict filters the noise, so the CTI team spends its hours on the campaigns that move the threat picture, not on per-domain look-ups.
- Enrich: Domain · IP · CIDR · ASN · SHA256
- Infrastructure trust: CIDR / ASN scored directly
- recommended_action
- block
- evidence_saturation
- 4 / 5
- recommended_action
- block_cidr
- evidence_saturation
- 3 / 5
Most of the queue is noise. The campaign hides behind it.
The CTI queue is noisy. Most IOCs are routine. The campaign that matters sits behind the noise, and the team finds it after the window closed.
Reputation feeds publish what was already known. Cold-start infrastructure (registered last week, activated yesterday) sits below the threshold. By the time the feed lights up, the campaign has rotated.
Pivoting per-domain at PassiveTotal or DomainTools surfaces neighborhoods, but does not score them. The analyst still has to read every neighbor by hand. The signal exists; the bookkeeping buries it again.
“Domains are infinite. Adversary patterns are finite, and statistically repeatable.”
Verdict, evidence, neighborhood. In one call.
POST /enrich on the IOC returns the verdict plus the behavioral and infrastructure signals, the same verdict shape the SOC already reads, across every IOC type. When the campaign question is bigger than one domain, the same call scores the CIDR or ASN it lives in.
Open the IOC; read the verdict and its signal trail. Each behavioral signal (fast-flux DNS, bad co-tenancy, dormant-then-activated) carries one-sentence evidence, and evidence_saturation tells you when to trust the verdict outright versus hand it to an analyst.
Send the CIDR or ASN itself to /enrich: hosting trust, ASN reputation and co-tenancy signals come back in the same verdict shape. Sandbox and OSINT work starts on a triaged target, not every host.
Per-IOC verdict, then the block-level view. Triage informs investigation, never replaces it.
Score the IOC. Score the infrastructure. Catch the cold-start.
It starts with one /enrich call that scores any IOC. The same call scores CIDR and ASN scopes for infrastructure trust, and Behavioral Zero-day catches cold-start infrastructure before the feeds publish.
Score any IOC the moment it lands.
One POST /enrich call returns the verdict, risk_score, risk_level and recommended_action: the triage decision at first sight.
Send a Domain, IP, CIDR, ASN or SHA256 to POST /enrich. The response carries a 0-100 risk_score, a six-level risk_level (clean to critical), a recommended_action enum and the behavioral and infrastructure signals behind the call. The CTI analyst reads the verdict and decides whether the IOC is worth investigation hours, before opening a single tab. SHA256 returns a file-level verdict; infrastructure trust scoring applies to Domain, IP, CIDR and ASN.
- POST /enrich
- risk_score · risk_level
- recommended_action
Score the neighborhood. Not just the domain.
Send the IP, CIDR or ASN itself to /enrich. Hosting trust, ASN reputation and clustering come back as signals in one call.
POST /enrich accepts Domain, IP, CIDR or ASN with the same response shape. Hosting trust, ASN reputation, datacenter scoring and infrastructure clustering surface as signals.
- POST /enrich
- cluster-level
- hosting trust
Catch infrastructure before reputation feeds publish.
Behavioral signals fire on cold-start domains. Reputation feed match is not required.
VerdictIQ models adversarial infrastructure behavior: dormant-then-activated lifecycles, co-tenancy with known malicious neighbors, fast-flux DNS rotation, short-lived SSL. Signals fire whether or not the IOC is in any feed. The verdict carries the reasoning.
- POST /enrich
- behavioral
- reputation-independent
Pre-hoc, not post-hoc. By design.
VerdictIQ is a triage layer, not a forensic tool. The line is explicit: we score the IOC the moment it lands; the CTI team investigates the cluster the verdict surfaces.
Verdict, recommended_action and behavioral signals land in seconds. The CTI analyst decides whether to invest investigation hours on a triaged target, not on every IOC in the queue.
Sandbox, payload analysis, OSINT frameworks: the investigation layer. VerdictIQ feeds it a triaged target with a verdict and a signal trail. We do not replace the sandbox; we tell you which IOC deserves one.
“Find evidence after the burn, douse fire after it starts. We detect smoke before the fire.”
API into the CTI workbench.Downstream surfaces read the same verdict.
VerdictIQ is API-first. The CTI workbench (TIP, OSINT framework, custom tooling) calls POST /enrich directly, and the SOC's SIEM, SOAR, EDR and DNS surfaces consume the same verdict downstream.
TIP and CTI workbenches (MISP, ThreatConnect, Anomali or custom tooling) call the same endpoint. The verdict, recommended_action and signal trail land in the workbench, with a per-call audit trail. No analyst note has to reconstruct the reasoning.
When the CTI verdict reaches the SOC's SIEM, SOAR, EDR or DNS firewall, the response shape is identical. The team's findings propagate without a rewrite: same parser, same audit trail, on every surface.
Latency, rate limits, error codes and timeout behaviour live in the API reference; wire your workbench to fail-open or fail-closed per policy.
All vendor names and logos are the property of their respective owners. Listing indicates API compatibility, not partnership or endorsement.
Triage one IOC. Then score its neighborhood.
Get an API key. Call /enrich on the IOC. Read the behavioral verdict. Send the ASN or CIDR to the same endpoint. Decide which cluster gets investigation hours, with the evidence in the payload.