enrich_ioc

Connect to this endpoint to inspect the live schema for enrich_ioc and invoke it with your own arguments.

Indexed input schema

{}

Risk classification

Inferred read-only · medium confidence · heuristic, not a guarantee.

• No write-capable action terms were found; this is not proof that invocation has no side effects.

Parent server

tweetfeed.live

Related tools

• query_iocs — Query the TweetFeed API for Indicators of Compromise (IOCs: URLs, domains, IPs, MD5/SHA256 hashes) shared by the infosec community on Twitter/X.
• check_url — Check whether a URL (or substring) appears in the TweetFeed corpus over the past 30 days.
• check_ip — Check whether an IP address appears in the TweetFeed corpus.
• check_hash — Check whether a file hash (MD5 or SHA-256) appears in the TweetFeed corpus.
• list_recent_iocs — List TweetFeed IOCs added since a given date, useful for delta-syncing a blocklist or Threat Intelligence pipeline.
• get_tag_info — Bundle of TweetFeed activity for a single tag: aggregate counts across today/week/month/year windows plus the most recent IOCs.
• get_trending — Top tags and IOC-type distribution for a given time window, computed from the live counts.json aggregate.
• get_campaigns — AI-clustered campaign groupings of the last 30 days of community-shared TweetFeed IOCs: each campaign bundles related URLs/domains/IPs/hashes under a name, a short context summary, a clustering confidence (high/medium/low), and a targeted brand/sector/country when identified (AI-inferred, may be null; sector is a STIX 2.1 industry-sector-ov slug, country ISO 3166-1 alpha-2), a ttps array of up to 4 MITRE ATT&CK Enterprise technique ids (AI-inferred, closed vocabulary, deliberately infrastructure-only because the clustering step never observes a payload running - so it names things like staged payloads or dynamic-DNS C2, never encryption or persistence; may be an empty array), threat_types and families rollups over the full campaign membership, not just the sample (families is malware family counts and usually empty since attribution is sparse; enriched_count says how many of the campaign's IOCs those two rollups cover), an infra array when the campaign has at least one IP IOC (ASN/org, IP count, country per network, sorted by IP count descending), an optional patterns array (up to 3 deterministic regexes over the campaign's own registered domains, each with evidence counts: domain_count, ioc_count, domains_elsewhere_30d, examples, first_seen/last_seen; live since 2026-09-01 but earned by a minority of campaigns, so absent on most - only families whose registered domains share a strong enough naming shape get one), an optional history object (365-day evidence behind the 30-day card: first_seen_365d/last_seen_365d, domains_365d, iocs_365d, iocs_before_window and a by_pattern breakdown; absent when the yearly scan failed), anchors.families only on an orphan hash/IP bucket that local enrichment attributed to one malware family (such a bucket has no domain/path/tag anchor - the shared family is what makes it one campaign), plus a sample of member IOCs, each optionally carrying its own ai threat_type/family and net org/country, mirroring enrich_ioc.