How do I enrich alerts with threat intelligence automatically?

Tines 3B: Ask + Answer
1

When an alert comes in, my team manually looks up indicators across a few intel sources, and it’s slow. How do I automate alert enrichment with threat intelligence in 3B? I’m curious how to pull in context from multiple sources and attach it back to the alert. A description of the general pattern would help me picture the build.

2

Think of it as a linear flow with a fan-out in the middle:

  1. Trigger / ingest the alert. Start with a step that receives the alert. This can be a webhook route that your SIEM or detection tool posts to, or a scheduled step that polls an alert queue. The alert lands as structured data you can reference downstream.

  2. Extract the indicators. Add a step that parses the alert and pulls out the observables you want to enrich: IPs, domains, file hashes, URLs, user names. Normalize them into a clean list so the rest of the flow does not care about the original alert format.

  3. Fan out to your intel sources. For each indicator, call each intelligence source you use (for example VirusTotal, GreyNoise, AbuseIPDB, an internal reputation database). Two ways to structure this:

    • One step per source, each taking the indicator list and returning its verdicts. This keeps each integration isolated and easy to reason about.
    • A single enrichment step that loops over indicators and sources together, if you prefer fewer steps.

    Run the source lookups in parallel where they have no dependency on each other so the total time is roughly the slowest single lookup rather than the sum of all of them.

  4. Merge and normalize the results. Collect the responses from every source into one consolidated object per indicator. This is where you reconcile different vocabularies into a common schema, for example a single score, verdict, and sources array. You can also compute a simple rollup here, such as “malicious if any source flags it” or a weighted score.

  5. Attach the context back to the alert. Send the merged enrichment to wherever the alert lives. Typically that is an API call back to your SIEM, case system, or ticketing tool to update the alert or add a comment or field with the enrichment summary. If your platform supports it, write it as structured fields so analysts can filter and sort on it.

  6. Optional: act on the verdict. Once the alert carries context, you can branch. High-confidence malicious can auto-escalate or open a case; clearly benign can auto-close or suppress; ambiguous goes to a human.

Practical notes for building it in 3B

  • Each integration is just a code step making an authenticated HTTP request. Connect each intel provider as a connector so credentials are injected and you never hardcode keys.
  • Handle partial failures gracefully. If one source times out or rate-limits, capture that as “no data from source X” rather than failing the whole run, so the analyst still gets whatever enrichment succeeded.
  • Cache repeat lookups if you see the same indicators often. A small persistent store keyed by indicator with a short TTL cuts API cost and speeds up runs.
  • Keep the merge and the rollup logic in their own step so your scoring rules live in one place and are easy to tune later.

The core idea: ingest, extract, fan out to sources in parallel, merge into a common schema, write back to the alert. That structure keeps each intel source independent and makes it easy to add or remove a source without reworking the rest of the flow.