Threatlist Analyze Agent
On-Demand IOC Investigation
On-Demand IOC Investigation
// Overview
A production module inside a Security Command Center (SCC) platform that takes a single indicator of compromise (IP, domain, URL, or hash) and runs a full analyst investigation autonomously, fanning out to many intelligence sources in parallel, sending a browser OSINT agent to visit and reason about the target, then synthesizing a verdict with an LLM: malicious, suspicious, benign, or an official asset.
// Background
The challenge
Every suspicious IOC triggers the same multi-step ritual.
Checking many feeds, WHOIS, and the live site, manually.
Same manual ritual, every time
Each IOC meant hand-checking several feeds, WHOIS,
past alerts, and the live site, minutes per indicator.
Repetitive multi-tab work, impossible at volume
Single-source verdicts were brittle
Relying on one reputation feed gave false confidence;
real judgment needs multiple signals fused together.
One feed says clean; another says malicious
B2B partners & own assets misflagged
Without company knowledge, B2B partner domains and
own infra looked suspicious, generating false positives.
B2B context missing → partners flagged malicious
Recon didn't scale
Actually visiting a site to read its branding and intent
was too slow to do for every indicator.
Human-grade recon was the bottleneck
Net effect
Manual multi-tab investigations, single-source verdicts,
and no brand ground truth made IOC triage slow,
inconsistent, and error-prone.
// Solution
Threatlist agent, parallel enrichment + browser OSINT
Data sources
One IOC (IP/domain/hash)
by analyst or automation
Intelligence sources
TIP · WHOIS · reputation APIs
knowledge base · asset RAG
Pipeline
Enrich
parallel asyncio
TIP·WHOIS·RAG
Enrich
AI Agents
AI browser agent
search · visit
Recon
Evidence
aggregate all
enrich+OSINT
Merge
Synthesis
DSPy signature
verdict+score
Synthesize
Result
stateless JSON
OFFICIAL / MALICIOUS
Result
Parallel asyncio fan-out · bounded semaphores · browser-use agent (read-only) · DSPy verdict synth · stateless JSON
// Impact
IOC triage: multi-tab → one call
Before · by hand
5+ tabs · WHOIS · open siteAfter · agent call
one call → parallel enrich → verdict6+
concurrent enrichment sources per IOC
Operational impact
Whole investigation in one call
minutes → one scored verdict
Fused, robust judgments
concurrent enrichment beats one feed
B2B & official assets protected
B2B partners → OFFICIAL, not malicious
Human-grade recon, automated
agent does 'go look' at machine scale
Composable by design
stateless JSON: portal, chat, pipelines
Every agent run traced
OSINT steps replayable · audit trail
Results
Verdict classes
4
Enrich sources
6+
stateless
0
explainable
100%
Verdict · risk score · matched brand ·
key indicators · summary per IOC.
// Tech Stack
| Layer | Technologies |
|---|---|
| Enrichment | Local TIP store + historical alerts (PostgreSQL), commercial threat-intel & reputation APIs, WHOIS/RDAP, live browse, asset-search hybrid RAG |
| OSINT agent | browser-use autonomous agent, LLM reasoning, structured-findings extraction, Laminar trace capture, semaphore-bounded concurrency |
| Verdict synthesis | DSPy signature, LLM, secret-backed credentials (Infisical) |
| Concurrency | asyncio parallel fan-out, bounded semaphores, timeouts |
| Backend API | FastAPI (stateless JSON, no DB writes) |
// Architecture & Diagrams
An analyst submits a single indicator; the agent gathers enrichment, history and live evidence, and returns one explained verdict.
Disclaimer: sample visuals may contain anonymized, simulated, or non-production values for presentation purposes.