domains / families / security / performing-ioc-enrichment-automation

performing-ioc-enrichment-automation

separate

'Automates Indicator of Compromise (IOC) enrichment by orchestrating

When to use

• SOC analysts need to quickly enrich IOCs from multiple sources during alert triage
• High alert volumes require automated enrichment to reduce manual lookup time
• Incident investigations need comprehensive IOC context for scope assessment
• SOAR playbooks require enrichment actions as part of automated triage workflows

When not to use

• bulk blocking decisions without analyst review

Skill page

Source