Enrich each alert with domain and IP risk before a playbook runs.
Your security orchestration, automation and response (SOAR) platform runs playbooks on alerts, and many alerts hold domains, URLs and IPs. The question is what your playbooks know about them. Take new findings from Threat Feed or Category Feed, and look up the rest with the Query API.
SOAR threat intelligence is domain, URL and IP risk data, plus content categories for domains, URLs and millions of IPs, that a SOAR platform uses to enrich alerts and decide what a playbook does next. alphaMountain provides it as URL Classification (92 content categories), Threat Feed (a 1.0 to 10.0 risk score) and Domain/IP reputation factors. A feed is a downloaded list of new findings, and you choose what it carries: Threat Feed by score range, Category Feed by category.
Enrich each alert with three kinds of context.
- Domains and URLs: a risk score plus one of 92 content categories.
- IP addresses: a risk score, plus a content category for a subset of IPs.
- Reputation factors: registration records, popularity and DNS history, so an analyst can see why a score is high.
A score of 1.0 is very safe and 10.0 is known malicious. Scores from 7.0 to 8.49 are suspicious, so warn or block based on your risk appetite. Scores of 8.5 and up are malicious, and we recommend blocking them.
Sort incidents by risk.
Use the score to rank alerts, so analysts can start with the highest-scoring domains and IPs. A playbook can branch on the score. For example, your team might block a score of 8.5 and up and send a score from 7.0 to 8.49 to an analyst for review.
Let playbooks quarantine, block or investigate.
Use categories and scores as playbook conditions. Your playbook can use a phishing category or a high risk score as the condition to quarantine an asset, block a destination or start an investigation. For threat hunting, an analyst can look up a domain or IP from raw log data and see what your subscription covers.
Call it from a step, or keep a copy.
A playbook step can call the Query API for a one-time lookup. It returns what your subscription covers, a category or a risk score, from a database that updates every hour. For heavy enrichment, run a local database (DB) copy as a database that your own systems query. The Batch API sends batch updates to your local DB copy every hour, delivered as Category Batch or Threat Batch.
What each feed carries.
Choose what the feed carries. Threat Feed delivers new findings in the score range you choose, 7.0 and up by default. Category Feed delivers new findings in the categories you choose, such as phishing. Each feed is a list of just those findings.
Count domains and IPs, not alerts.
One alert can hold several domains and IPs, and a busy platform sees many alerts, so lookups add up fast.
- Up to about 100,000 lookups a day: the Query API alone fits.
- Above that: we recommend batch. The Query API handles up to 300,000 a day, but your local DB copy keeps response time under your control.
Choose the feed for your platform.
Choose Threat Feed, Category Feed or both. Tell us the score range or the categories your playbooks need, and we'll scope the feed to match.
Try it first.
Ask for a free trial, and we'll help you run a proof of value. You can look up a domain in threatYeti right now. If a verdict looks wrong, site owners can report a false positive. We score domains, URLs and IPs, not files.
FAQ
Can a playbook look up a domain or IP by itself?
Yes. Add a step that calls the Query API. It returns what your subscription covers, a category or a risk score. The API page lists the fields in each database.
Do you enrich file hashes or attachments?
No. We score domains, URLs and IPs, not files.
Does it work with our SOAR platform?
Your playbooks can call the Query API from a step, and the feed carries new findings by score range or category. Tell us which platform you run, and we'll confirm how you load the feed.
Bring your alert volume.
Tell us how many alerts your platform handles and how many domains and IPs they hold. We'll match the products, delivery and licensing to it.