Check Multiple IOC Reputation Value

[adem_netsys]

Hi guys,

When an Indicator is created, it extracts the existing enrich playbook data, but if there is one malicious IOC tool here, the indicator is flagged as malicious. We want to implement a check here to ensure there are at least two. How can we step this process? Has anyone done this before?

Thanks in advance

[jankit6]

Hello @adem_netsys 

As discussed, the issue was resolved after updating the playbook IRI value in the global variable "IP_Enrichment_IRI," which determines the playbooks that need to be executed to enrich the IP address.