Skip to content
Integrations
Skip navigation
Integrations
View as Markdown

Enriching Observables

What enrichment returns for IPs, domains, and AS numbers, the notes that carry threat evidence, and how to read the results.

Published Last updated

On this page (7)

Enriching Observables Documentation

What happens when you enrich an observable with Whisper, type by type, and how to read the results.

Triggering an enrichment

Three ways:

  • Manually. Open a supported observable and trigger Whisper from the Enrichment panel on the detail page.
  • Automatically. OpenCTI enriches every new in-scope observable as it is created, once automatic enrichment is turned on — see Configuration.
  • From a playbook. The connector works as a playbook step. If Whisper has nothing for an observable, the connector forwards the incoming bundle unchanged so downstream playbook nodes still receive it.

Run it again whenever you want current data. Re-enriching updates what is there instead of creating duplicates, because the STIX IDs are deterministic.

IP addresses

For an IPv4-Addr or IPv6-Addr seed the connector runs three queries:

  1. Direct neighbours. One hop in the graph around the IP: domains that resolve to it, its WHOIS contacts, registrant organization, geolocation, and related network entities.
  2. Threat context. Whisper's threat intelligence for the IP. If the IP is threat-listed, this becomes a note carrying the evidence chain.
  3. Network context. A two-hop walk to the announcing ASN. This adds the AS as an observable, an ANNOUNCED_BY relationship, and a note with the announced prefix and BGP flags (anycast, MOAS, withdrawn), plus the prefix's own threat level if Whisper has one.

Domain names

Domain enrichment is deliberately surgical. Instead of one broad query, the connector asks Whisper a set of targeted questions:

The domain's own records: A and AAAA records, CNAME target, nameservers, mail servers, current and previous registrar, registrant organization, and WHOIS email contacts. Each relationship is labeled with its record category, so an A record and an MX record are distinguishable in the UI.

Pivots through the domain: domains that use the seed as their nameserver, domains that use it as their mail server, its subdomains, and hostnames whose CNAME points at it.

Web links: sites the seed links to and sites that link to the seed.

Supporting context: the same threat-context evidence chain as IPs, the domain's SPF policy targets, WHOIS phone contacts, and a check of generated lookalike domains against the graph, which surfaces registered typosquats of the seed.

Each of those queries is bounded, and a truncated one says so in an overflow note on the seed stating the real count.

AS numbers

For an Autonomous-System seed the connector runs the one-hop neighbourhood query: the organization behind the AS, its location, and related network entities.

Notes

What does not fit the STIX relationship model arrives as a note on the seed, under Analyses → Notes: the threat-intelligence evidence chain, network context on IP seeds, overflow counts, DNS records OpenCTI cannot store, and the SPF, WHOIS-phone and lookalike findings on domain seeds. Data Mapping says what each one contains and why it is a note rather than an object.

When nothing comes back

The connector reports a status message on every work item, visible under Data → Ingestion → Connectors → Whisper. Two are worth knowing:

  • No Whisper data for <value> means the graph has no data anchored at that value. Treat it as "not covered", not "confirmed clean". Absence of threat listings at one granularity says nothing about the prefix or ASN above it.
  • No mappable Whisper relationships for <value> means Whisper knows the observable but everything around it fell outside what maps to STIX. This is rare.

Next steps