Threat Intelligence and IOC Triage

This scenario addresses a common daily question: when you only have an IP, domain, or hash, how can an Agent quickly produce a triage conclusion with cross-validation?

Flocks has Rex call multiple intelligence sources at the same time, such as ThreatBook, VirusTotal, GreyNoise, and FOFA, cross-check the conclusions, and then combine enterprise context, such as whether the IOC belongs to your assets or appears in historical alerts, to give a unified judgment.

Scenario Overview

Intelligence tasks are frequent and fine-grained in security operations. Each one does not take long, but the cumulative cost is significant.

• Log in to ThreatBook and check tags
• Log in to VT and review engine results
• Query GreyNoise to confirm whether it is a scanner
• Cross-judge conclusions from multiple sources
• Write the conclusion into a ticket or send it to a collaboration group

Flocks compresses this flow into one conversation: input one IOC and output one structured judgment.

Inputs and Outputs

Typical Inputs

• Single IOC: IP / domain / URL / sample hash
• A batch of IOCs / an IOC list
• Relevant context: which alert the IOC appeared in and which asset it corresponds to

Typical Outputs

• Triage conclusion: benign / suspicious / malicious, with confidence
• Tags / family / threat background: aggregated from intelligence sources
• Cross-validation results: each intelligence source's view plus Rex's consolidated judgment
• Recommended action: block / monitor / ignore
• Continuous tracking task, optional: long-term monitoring around key IOC / key organizations

Prerequisites

Dependency	Requirement
Model	The default model is sufficient; intelligence tasks rely relatively less on deep reasoning
Intelligence tools	At least one source is integrated; ThreatBook + VT + GreyNoise is recommended. See Internal Security Product Integration
API Key	Keys for each intelligence source are filled into the corresponding tools
Channels	Optional. Used to push triage results to alert investigation groups

Steps (WebUI)

Step 1: Create a Session and Submit the IOC

In Session Management -> + New Session, state the need directly:

"Triage IOC 8.8.8.8 for me. Query ThreatBook, VT, and GreyNoise, then cross-check and give a conclusion."

Step 2: Rex Queries Multiple Intelligence Sources in Parallel

Rex:

• Identifies the IOC type, such as IP
• Calls the integrated intelligence tools in parallel
• Receives raw returns from each source
• Aligns fields such as tags, family, last active time, and related samples

Step 3: Cross-judge and Output Structured Results

Rex's value is not only summarizing multiple query results. It also:

• Applies priority when source conclusions conflict, such as increasing ThreatBook weight when the enterprise mainly uses ThreatBook
• Considers IOC characteristics, for example public DNS like 8.8.8.8 is very likely a benign false positive from scanning rules
• Provides a concise conclusion, detailed reasoning, and recommended action

Step 4: Optional: Batch IOC / Continuous Tracking

A single IOC can be extended into:

• Batch: submit an IOC list, and Rex triages them in order and summarizes them into a table
• Continuous tracking: "Check these 10 IOCs every day and notify me when there are new tags or newly related samples" -> convert to Task Center
• Organization / event tracking: track TTP updates for an APT group and continuously enrich leads

Real Case Walkthrough: 8.8.8.8 IOC Triage

This case corresponds to a real environment session: determine whether 8.8.8.8 deserves attention.

Stage	Rex action	Conclusion / notes
Input	User provides single IP 8.8.8.8	Minimum-granularity task
Identification	Identifies it as a public IPv4	Automatically selects IP intelligence toolset
Parallel query	Requests ThreatBook, VT, and GreyNoise at the same time	Response time depends on the slowest source
Field alignment	Ownership information, malicious tags, active scanning records, related samples	ThreatBook returns Google public DNS; VT is clean; GreyNoise has many scanner hits but tag is "benign"
Cross-judgment	Multiple sources all point to "Google public DNS, benign infrastructure"	High confidence
Enterprise context enrichment	Checks whether it appears in recent alerts	If present, warns that it may be legitimate DNS outbound traffic misclassified
Conclusion	Benign / no action required; if it appears heavily as an alert match field, optimize detection rules	Conclusion based on multi-source evidence
Optional action	Write this triage as an example into a Skill: "decision template for public infrastructure IPs"	Similar IPs can reuse it next time

Threat intelligence triage extends beyond API fetching. It systematically cross-references multiple intelligence feeds while integrating enterprise context to deliver actionable conclusions.

Output Example

{
  "ioc": "8.8.8.8",
  "type": "ipv4",
  "verdict": "benign",
  "confidence": 0.95,
  "conclusion": "Google public DNS infrastructure; benign.",
  "sources": {
    "threatbook": {"tags": ["public_dns", "google"], "verdict": "benign"},
    "virustotal": {"malicious": 0, "suspicious": 0},
    "greynoise": {"classification": "benign", "actor": "Google Public DNS"}
  },
  "enterprise_context": {
    "recent_alerts": 42,
    "note": "Alert volume is high, but all events are DNS outbound traffic. Tune rule allowlists."
  },
  "suggested_action": "allowlist_in_detection_rules"
}

Batch / Continuous Tracking Modes

Batch Triage

Input 10 / 50 / 100 IOCs:

• Rex automatically slices the work, such as 10 IOCs at a time
• Conclusions for each batch are persisted independently
• A final summary table is produced, showing malicious / suspicious / benign / unknown distribution

Continuous Tracking

Create long-term tasks around "key IOC / key organizations / hot events":

• Daily task: check tag changes for a batch of IOCs
• IOC family tracking: notify when the same attacker has new samples
• Event tracking: track the latest TTP for a vulnerability or APT

These tasks are all attached to Task Center and run on schedule with channel pushes.

How Outputs Flow into Other Scenarios

Intelligence triage is rarely the endpoint. It is an upstream capability:

Downstream scenario	Usage
Alert Triage	Outbound IPs or download domains in alerts directly trigger an IOC triage subflow
Asset Discovery	When reverse-looking up external scanner IPs, determine whether they are malicious
Threat hunting Workflow	Start from a batch of IOC and expand outward to find related samples / related C2

Boundaries and FAQ

Question	Handling
Intelligence sources conflict	Define priority and consolidated judgment rules in a Skill, then let Rex follow them
Intelligence source API rate limits	Add rate limiting in a Skill, or introduce a cache layer and reuse recently queried results
Only one intelligence source is integrated	Usable, but confidence should be reduced; at least two sources are recommended for cross-checking
Want Rex to determine APT attribution	It can provide a reference view, but should not be the final conclusion; APT attribution is highly specialized
Enterprise IOC desensitization requirements	Key IOC can be SHA256-desensitized before query, where supported by the intelligence source
Results for a batch of IOC need to be stored	Let Rex persist them to Workspace in a unified JSON format, or write directly to ES / ClickHouse

---

Related Resources: Scenario Overview · Alert Triage · Internal Security Product Integration · Internet Asset Discovery · Skills