One solution, wired into your entire security stack.
One decision motor for every layer you already run: SIEM, SOAR, EDR, SWG, DNS firewall, CTI workbench. One response shape, one signal hierarchy. Wire it once; more than ten jobs read the same verdict.
Use cases are not abstract.
They are the queues your team lives in.
SIEM alert queue. SOAR playbook branch. EDR feed loader. CTI pivot panel. Every team has its own door into the verdict, and a different policy that hangs off it.
The jobs below are written from inside those queues, not from a datasheet. Pick the door your team came through.
Pick the one your queue lands on first.
More than ten canonical jobs across the same response shape. Each row carries the persona who lives the pain, the answer VerdictIQ returns, and the endpoint behind it.
Decide before the IOC fires, not after the incident report.
Operational verdict at alert time, not forensic reconstruction after the incident.
Most enrichment lands after the action. Tier-1 blocks first and explains later; CTI writes the report after impact.
POST /verdict returns a verdict, a recommended action and a signal trail at the moment the alert fires. The decision is operational, not archaeological. Same response shape across every queue.
- Pre-hoc decision
- POST /verdict
Actions land while they still change the outcome. The incident report reads what the system decided, not what an analyst guessed.
Cut alert noise. Catch the missed threats.
Verify SIEM verdicts at the moment they fire. Surface what is benign and what was missed.
Tier-1 spends 12-15 minutes per IOC stitching WHOIS, VirusTotal and Shodan into a still-ambiguous call. That is bookkeeping, not analysis.
Every alert payload calls /verdict. The verdict, the recommended action and the signal trail land in the alert before the analyst opens it. False positives drop without loosening detection. False negatives surface from the same call.
- FP/FN reduction
- POST /verdict
- audit-ready
Triage time collapses to seconds; analyst-A and analyst-B land on the same answer. Alert fatigue drops.
Drive playbook decisions from signals, not just scores.
Trigger hard, soft or observational branches per signal presence, score threshold or specific signal name.
A generic risk score is too coarse for policy: some branches must fire on a named signal, others on a threshold. SIEM and TIP feeds expose neither.
POST /verdict returns the full Group, Subgroup and signal hierarchy. Your playbook branches on score (above N), recommended_action (block_domain) or a named signal (visited_by_a_malicious_domain), taking hard, soft or observational routes.
- SOAR decision engine
- POST /verdict
Policy-aware automation without analyst-in-the-loop on every alert. Playbook conditions read deterministic fields, no NLP, no opaque scoring.
Catch infrastructure before reputation feeds publish.
Behavioral signals fire on cold-start domains; reputation feed match is not required.
Reputation feeds need a domain to misbehave, then publish, then propagate: 24 to 72 hours. Campaigns rotate inside that window.
VerdictIQ models adversarial infrastructure behavior: dormant-then-activated lifecycles, co-tenancy with malicious neighbors, fast-flux DNS rotation, hosting reuse. Signals fire with or without a feed match, and the verdict carries the reasoning.
- Zero-day detection
- POST /verdict
- behavioral
Cold-start campaigns get scored at first sight. Reputation gap closes.
For payload analysis or full campaign forensics, pair VerdictIQ with payload-analysis or threat-hunting tooling. We trigger the action; we don't reproduce the payload.
Score the infrastructure behind a domain deterministically.
Read ASN and hosting-provider trust straight off the domain verdict.
Abuse reuses the same ASN, the same datacenter, the same hosting provider. At single-domain scope that pattern stays invisible.
POST /verdict scores domains today; hosting trust, ASN reputation, datacenter scoring and infrastructure clustering come back as named signals in the same response. Direct IP, CIDR, ASN and file hash inputs are coming soon, in the same shape.
- Infrastructure trust scoring
- POST /verdict
- cluster-level
Targeted policy on hosting reputation, not blanket country blocks. Legitimate traffic flows; malicious neighbors stop together.
Replay shipped SIEM decisions at scale.
Bulk-feed a day of SIEM verdicts, surface the false positives and the false negatives buried in them.
The block, allow and alert decisions your stack already shipped sit in the SIEM unchecked. No loop closes on the false positives or the false negatives inside them.
POST /verdict/bulk takes a day of decisions in one call and flags FP, FN, inconsistencies and IOCs whose risk shifted since the original call. Same signal hierarchy, same audit trail; built for batch jobs and weekly review.
- Decision verification
- POST /verdict/bulk
- FP/FN feedback loop
- audit replay
Continuous decision quality measurement. Operations team gets a closed-loop signal on what the SIEM kept and what it missed.
Score 10,000 IOCs in one call. Wire the pipeline once.
SIEM enricher and SOAR pipeline integration without per-IOC HTTP overhead.
Per-IOC calls bury bulk paths: log enricher loops, threat feed evaluation, EDR allowlist scrub. Rate limits make linear loops infeasible.
POST /verdict/bulk accepts up to 10,000 IOCs per call. Same response shape per item. Built for log-pipeline batch, scheduled threat-feed evaluation and EDR/SWG list hygiene jobs.
- Bulk throughput
- POST /verdict/bulk
- 10K/call
Bulk paths scale to feed volume. The SIEM enricher and the SOAR pipeline read one contract.
One ticket, every IOC, one call.
A single incident with 16 domains gets one verdict bundle, not 16 round-trips.
Incident tickets carry mixed-type IOC lists. Analysts paste each into its own tab and lose the trail of which IOC scored what.
POST /verdict/bulk takes the full ticket payload in one request: domains today, with IP, CIDR, ASN and file hash coming soon. Per-IOC verdict, signals and evidence come back indexed to input order, as a single attachment.
- Ticket scope verdicts
- POST /verdict/bulk
Ticket triage runs at incident granularity, not IOC granularity. Audit trail attaches to the case, not the analyst's clipboard.
Read the verdict like a senior analyst wrote it.
Optional narrative layer turns the signal trail into a closure-ready summary in plain language.
Tier-1 escalates with the verdict already in hand, because writing the closure note takes longer than reading it. MSSP voice drifts across tenants.
Opt-in VerdictIQ AI layer composes a senior-analyst narrative on top of the deterministic verdict. The score and signals stay deterministic; the narrative summarizes them for the closure note. Toggle per query or per tenant.
- AI narrative
- POST /verdict
- narrative-read
Tier-1 closes more tickets without escalation. MSSP voice stays consistent across analysts and shifts.
Defend every blocked legitimate domain at audit.
Every verdict opens to signal, evidence and analyst Q&A: the same trail compliance review reads.
Blocks in finance, telco and healthcare face customer complaints, regulator review and internal audit. Opaque vendor scores don't defend; analyst notes drift.
Every VerdictIQ verdict carries a deterministic signal trail and a stable evidence shape. Compliance reads the same view your analyst saw. Per-API-key partitioning keeps the audit boundary clean.
- Audit defensibility
- POST /verdict
- POST /verdict/bulk
Audit and customer complaints get answered from the verdict, not the analyst's memory.
Turn behavioral signals into SIEM rules.
Every named signal is queryable, exportable and ready for Sigma, KQL or SPL conversion.
Detections written against opaque, vendor-locked risk scores are fragile and drift-prone. Rules need portable signal definitions.
Signal names and evidence shapes are stable and documented. Export a verdict, inspect the signals behind it, codify the pattern in Sigma, KQL or SPL. The signal library is your rule catalog.
- Detection engineering
- POST /verdict
Detection rules track named signals, not opaque vendors. Drift becomes visible at the signal layer.
Two endpoints behind every job.
Use cases hit one of two product surfaces. The job is the lens; the endpoint is the contract.
Real-time verdict on a single IOC. Drives FP/FN, SOAR, infra trust, zero-day.
- Domain input today; IP · CIDR · ASN · SHA256 coming soon
- same response shape
- explainable
Replay shipped SIEM decisions at scale. Drives bulk decision verification.
- batch input
- per-IOC verdict + delta vs prior
- audit-friendly export
Pick a job. Try the verdict.
Get an API key. Send your first IOC. Wire the response into the use case that hits your queue first. Move to the next when you have proof.