IOC threat analyzer with VirusTotal enrichment and case management
Try this example in Tines 3B
Import nowA threat-intelligence triage workflow for security analysts that accepts suspicious emails, alerts, or IOC lists, extracts and refangs indicators (IPs, domains, file hashes, URLs), enriches them via VirusTotal, and returns verdicts with audible alerts for malicious findings. Results are cached to avoid redundant lookups, and malicious indicators automatically create or update Tines cases with evidence and severity. Analysts access the workflow through a private browser interface that displays scan history, cache status, and case links.
The problem
Security analysts triaging suspicious emails, alerts, or indicator lists face the tedious manual work of extracting domains, IP addresses, file hashes, and URLs, then checking each one against threat intelligence sources like VirusTotal. This workflow automates the entire triage process: paste any free text containing potential indicators, and it extracts, refangs, and enriches each IOC with reputation data, returning clear verdicts and metadata with an audible alert when malicious indicators are detected. Results are cached to eliminate redundant lookups, and malicious findings automatically create or update cases in Tines with evidence and severity, streamlining investigation and response.
Solution and impact
Security teams save hours of manual IOC extraction and lookup work, accelerating threat triage from minutes to seconds. Analysts get immediate, actionable verdicts on every indicator with audible warnings for malicious findings, while automatic case creation ensures no threat slips through the cracks. Intelligent caching reduces API usage and speeds up repeat investigations, and the browser-accessible interface means anyone on the team can triage indicators without leaving their workflow.