IOC threat analyzer with VirusTotal enrichment and case management
Build a threat-intelligence triage workflow for security analysts. Trigger it from a private browser-accessible webpage where an analyst can paste a suspicious email, alert, IOC list, or other free text. Extract and refang unique IP addresses, domains, file hashes, and URLs, then check their reputations with VirusTotal—or another threat-intelligence service. Return clear per-indicator verdicts, detection summaries, metadata, and links to the source intelligence, with an audible warning when malicious indicators are found. Cache previous results in persistent storage to avoid unnecessary repeat lookups while periodically refreshing stale intelligence. For malicious or suspicious indicators, create a Tines case or a ticket in the team’s preferred case-management system with the evidence and severity; reuse and update the existing case when the same indicator appears again. Present scan history, cache status, and case links in the analyst interface, and handle invalid input, empty results, unavailable reputation data, and dependency failures clearly.
What this prompt builds
A threat-intelligence triage workflow for security analysts that accepts suspicious emails, alerts, or IOC lists, extracts and refangs indicators (IPs, domains, file hashes, URLs), enriches them via VirusTotal, and returns verdicts with audible alerts for malicious findings. Results are cached to avoid redundant lookups, and malicious indicators automatically create or update Tines cases with evidence and severity. Analysts access the workflow through a private browser interface that displays scan history, cache status, and case links.
The problem
Security analysts triaging suspicious emails, alerts, or indicator lists face the tedious manual work of extracting domains, IP addresses, file hashes, and URLs, then checking each one against threat intelligence sources like VirusTotal. This workflow automates the entire triage process: paste any free text containing potential indicators, and it extracts, refangs, and enriches each IOC with reputation data, returning clear verdicts and metadata with an audible alert when malicious indicators are detected. Results are cached to eliminate redundant lookups, and malicious findings automatically create or update cases in Tines with evidence and severity, streamlining investigation and response.
Solution and impact
Security teams save hours of manual IOC extraction and lookup work, accelerating threat triage from minutes to seconds. Analysts get immediate, actionable verdicts on every indicator with audible warnings for malicious findings, while automatic case creation ensures no threat slips through the cracks. Intelligent caching reduces API usage and speeds up repeat investigations, and the browser-accessible interface means anyone on the team can triage indicators without leaving their workflow.