{"uid":"cap_cfbqudHlAD4MoxN6PTYpZ","slug":"threat-ioc-enrichment-d6eeb23b","name":"Threat IOC Enrichment","description":"Type-agnostic threat-intelligence enrichment for a SOC or DFIR agent. Give one indicator of compromise of any kind — a file hash, IP, domain, URL or CVE id — and get one normalized, cited verdict. Auto-detects the type, dispatches to the right grain, fuses the sources and returns a verdict, an is_malicious flag, a confidence, malware family when known, per-source citations and reasons. Not a guarantee.","url":"https://payai.agentstools.dev/threat/ioc?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","required":["indicator"],"properties":{"type":{"enum":["md5","sha1","sha256","hash","ip","ipv4","ipv6","domain","url","cve"],"type":"string","description":"Optional type override; auto-detected if omitted"},"indicator":{"type":"string","description":"The indicator of compromise: a file hash (md5/sha1/sha256), IP, domain, URL or CVE id"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_bdyDzhwVJgZj0tbGpvyqD","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Auto-detects and enriches any indicator of compromise (hash, IP, domain, URL, or CVE) with a normalized threat-intelligence verdict, confidence score, and per-source citations.","exampleAgentPrompt":"Can you check if the IP address 185.220.101.45 is malicious? I need a threat-intelligence verdict with confidence score and which sources flagged it.","exampleUseCases":[{"title":"SOC alert triage for suspicious IP","prompt":"We got an alert for outbound traffic to 45.33.32.156 — can you pull a threat-intel verdict on that IP and tell me if it's a known bad actor and what confidence level you have?"},{"title":"Malware sample hash investigation","prompt":"I have a SHA256 hash from a suspicious file we found on an endpoint: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 — can you check if it's associated with any known malware family?"},{"title":"CVE exploitation check for patch prioritization","prompt":"Is CVE-2023-44487 actively being exploited in the wild? I need a threat verdict and confidence score so I can prioritize our patching this week."}],"resultDescription":"A normalized threat-intelligence response containing: a human-readable verdict string, an is_malicious boolean flag, a confidence score (0–1), the detected IOC type, the malware family if identified, and per-source citations each including the source name, its individual verdict, and the reason or evidence it provided. The result is aggregated from multiple threat-intelligence sources.","failureModes":["Unrecognized or malformed indicator format returns an error — ensure hash length matches MD5/SHA1/SHA256 standards","Unknown or very new IOC may return low confidence with no malware family","CVE IDs must follow standard format (CVE-YYYY-NNNNN) or auto-detection may fail","Rate limiting or upstream source unavailability may degrade confidence or citation count","Ambiguous indicators (e.g. short strings that could be multiple types) may be misclassified without a type override"],"whenToPreferThis":"Use this endpoint when you need a single, fused, source-cited threat verdict for any IOC type without having to route to separate hash, IP, domain, or CVE lookup services. Ideal for SOC automation, DFIR playbooks, and alert-enrichment pipelines where speed, normalization, and multi-source fusion matter more than deep drill-down per source. Prefer this over single-source tools when you want a confidence-weighted verdict rather than raw, uninterpreted feed data.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T00:44:08.263Z","isFirstParty":false,"canonicalSlug":"threat-ioc-enrichment-d6eeb23b"}