Check Multiple IOC Reputation Value

[adem_netsys]

Hi guys,

When an Indicator is created, it extracts the existing enrich playbook data, but if there is one malicious IOC tool here, the indicator is flagged as malicious. We want to implement a check here to ensure there are at least two. How can we step this process? Has anyone done this before?

Thanks in advance