The "Recorded Future - IP Address Enrichment with Cache" workflow template is designed to enhance threat intelligence by enriching IP addresses with reputation data. It efficiently checks if an IP's reputation has been cached within the last 24 hours, returning cached data if available. If not, it retrieves fresh data from Recorded Future, caches it, and provides a comprehensive analysis. This workflow is ideal for organizations seeking to streamline threat intelligence processes and improve incident response times.
Optional Triggers
["This workflow is intended to be used as a function."]
Use Cases
Function , Threat Intelligence Enrichment
Workflow Breakdown
Trigger the workflow and provide an IP Address.
Lookup global variables to see if IP addresse's reputation has been saved in the past 24 hours.
If reputation is found on local cache, the saved data is returned to the parent workflow.
When no reputation is found cached, a summary of the analysis data is created and saved with the original api data.
Vendors
Utils, Recorded Future, Torq
Workflow Output
Returns full analysis data and a summary of the information.
Tips
Set "Provide Raw Data Analysis" to true or false to add or remove original vendor information to the output.