Indicator Enrichment
Everything worth knowing about one indicator, on a single card. Give it a domain or an address and it fills in the picture: who registered it, where it's hosted and in which country, its mail and name servers, the network behind it, and a reputation read. The fast way to go from a bare indicator to real context before you decide what to do with it.
How it uses the graph
Traverses the WHOIS, DNS, email, BGP, TLS, threat-intel layers of the graph, in 15 steps:
Pulling the domain's registrar, registrant org, emails and phones…
Listing the domain's authoritative nameservers…
Listing the domain's mail exchangers…
Resolving the domain to IPs, prefixes and ASNs…
Reading the HOSTNAME threat verdict and set flags…
Listing the feeds and categories the domain appears in…
Listing the domain's SPF include mechanisms…
Looking up certificate-transparency observations for the domain…
IPv6 resolution (AAAA)…
GeoIP location (IP input)…
Network of an IP (prefix & ASN)…
Reverse-DNS neighbors (IP input)…
Egress vendor & cloud region (IP input)…
Egress vendor & cloud region (prefix input)…
Nearest vendor & siblings (Atlas walk)…
Why each step runs
- 01Registration identity. Collapses the WHOIS identity arms (HAS_REGISTRAR, REGISTERED_BY, HAS_EMAIL, HAS_PHONE) into one attribute/value table — the core of the Iris record card and the cleanest pivot selectors.
- 02Nameservers. Reverse NAMESERVER_FOR (NS → domain) with DISTINCT to dedupe duplicate edges — the DNS hosting fingerprint.
- 03Mail servers. Reverse MAIL_FOR (MX → domain) with DISTINCT — the email-delivery posture and a common SaaS-provider tell.
- 04Resolution & network. RESOLVES_TO → IPV4, then the 2-hop ANNOUNCED_BY → ROUTES to the owning ASN — where the domain actually lives on the network.
- 05Risk verdict & flags. Surfaces the HOSTNAME verdictScore/verdictLevel plus any set is* boolean as the record's risk line — context for the whole card without re-scoring.
- 06Threat-intel feeds. LISTED_IN → FEED_SOURCE → BELONGS_TO → CATEGORY — which threat (or popularity/trust) feeds carry the domain and under what category.
- 07SPF includes. SPF_INCLUDE → HOSTNAME exposes the authorized senders the SPF record delegates to — the email-trust supply chain.
- 08Certificate-transparency observations. SEEN_IN_CT → CT_OBSERVATION surfaces cert subjects (incl. wildcard) seen for the domain — a TLS sibling/coverage tell. Sparse on this graph; skipped cleanly when thin.
- 09IPv6 resolution (AAAA). Shows the IPv6 (AAAA) addresses the domain resolves to, which the anchor's IPv4-only resolution never surfaces.
- 10GeoIP location (IP input). For a raw IP indicator, gives the city and country GeoIP places the address in, so the record card carries geography even when the input is not a domain.
- 11Network of an IP (prefix & ASN). For a raw IP indicator, maps the address to the announced prefix and the ASN (with name) that routes it, the network context the anchor only computes for domains.
- 12Reverse-DNS neighbors (IP input). Reverse-resolves an IP to every hostname pointed at it, revealing co-tenant and sibling domains sharing the address.
- 13Egress vendor & cloud region (IP input). Attributes an IP to the CDN/cloud vendor and cloud region its registered prefix is delegated to, so the record shows who actually operates the hosting.
- 14Egress vendor & cloud region (prefix input). For a CIDR prefix indicator, attributes the whole block to its delegated CDN/cloud vendor and cloud region.
- 15Nearest vendor & siblings (Atlas walk). When a host has no direct vendor attribution, finds the closest known vendors and sibling hosts sharing its infrastructure.