Threatlist Analyze Agent
On-Demand IOC Investigation
A production module inside a Security Command Center (SCC) platform that takes a single indicator of compromise (IP, domain, URL, or hash) and runs a full analyst investigation autonomously — fanning out to many intelligence sources in parallel, sending a browser OSINT agent to visit and reason about the target, then synthesizing a verdict with an LLM: malicious, suspicious, benign, or an official asset.
// Overview
What it does. When an analyst encounters a suspicious IP, domain, URL, or file hash, the manual investigation is the same every time: check it against threat-intel feeds, look up WHOIS/registrar and hosting, see if it's appeared in past alerts, maybe open it in a sandbox, and finally decide — is this malicious, suspicious, benign, or actually one of our own official assets? This module does that whole investigation on demand and returns a single structured verdict with a risk score, the matched/impersonated brand, the indicators that fired, and a written rationale. Crucially it also distinguishes official vs impersonation, so a legitimate corporate domain isn't flagged as a threat.
// Background
The challenge
Every suspicious IOC triggers the same multi-step ritual.
Checking many feeds, WHOIS, and the live site — manually.
Same manual ritual, every time
Each IOC meant hand-checking several feeds, WHOIS,
past alerts, and the live site — minutes per indicator.
Repetitive multi-tab work, impossible at volume
Single-source verdicts were brittle
Relying on one reputation feed gave false confidence;
real judgment needs multiple signals fused together.
One feed says clean; another says malicious
B2B partners & own assets misflagged
Without company knowledge, B2B partner domains and
own infra looked suspicious — generating false positives.
B2B context missing → partners flagged malicious
Recon didn't scale
Actually visiting a site to read its branding and intent
was too slow to do for every indicator.
Human-grade recon was the bottleneck
Net effect
Manual multi-tab investigations, single-source verdicts,
and no brand ground truth made IOC triage slow,
inconsistent, and error-prone.
// Solution
Threatlist agent — parallel enrichment + browser OSINT
Data sources
One IOC (IP/domain/hash)
by analyst or automation
Intelligence sources
TIP · WHOIS · reputation APIs
knowledge base · asset RAG
Pipeline
Enrich
parallel asyncio
TIP·WHOIS·RAG
Enrich
AI Agents
AI browser agent
search · visit
Recon
Evidence
aggregate all
enrich+OSINT
Merge
Synthesis
DSPy signature
verdict+score
Synthesize
Result
stateless JSON
OFFICIAL / MALICIOUS
Result
Parallel asyncio fan-out · bounded semaphores · browser-use agent (read-only) · DSPy verdict synth · stateless JSON
// Impact
IOC triage: multi-tab → one call
Before · by hand
5+ tabs · WHOIS · open siteAfter · agent call
one call → parallel enrich → verdict6+
concurrent enrichment sources per IOC
Operational impact
Whole investigation in one call
minutes → one scored verdict
Fused, robust judgments
concurrent enrichment beats one feed
B2B & official assets protected
B2B partners → OFFICIAL, not malicious
Human-grade recon, automated
agent does 'go look' at machine scale
Composable by design
stateless JSON: portal, chat, pipelines
Every agent run traced
OSINT steps replayable · audit trail
Results
Verdict classes
4
Enrich sources
6+
stateless
0
explainable
100%
Verdict · risk score · matched brand ·
key indicators · summary per IOC.
// Tech Stack
| Layer | Technologies |
|---|---|
| Enrichment | Local TIP store + historical alerts (PostgreSQL), commercial threat-intel & reputation APIs, WHOIS/RDAP, live browse, asset-search hybrid RAG |
| OSINT agent | browser-use autonomous agent, LLM reasoning, structured-findings extraction, Laminar trace capture, semaphore-bounded concurrency |
| Verdict synthesis | DSPy signature, LLM, secret-backed credentials (Infisical) |
| Concurrency | asyncio parallel fan-out, bounded semaphores, timeouts |
| Backend API | FastAPI (stateless JSON, no DB writes) |
// Architecture & Diagrams
Disclaimer: sample visuals may contain anonymized, simulated, or non-production values for presentation purposes.