Skip to content
TISC Enrichment integrations › TISC Integrations › Integrate › Threat Intelligence Security Center › Security Operations
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Configure Threat Lookup

Scan selected observables for malware using Threat Intelligence to determine if they are malicious. Use this lookup to assess security threats from IP addresses, URLs, file hashes, and other observable types.

Before you begin

Role required: sn_sec_tisc.admin

Note: The Enrichment Integrations module appears only if at least one integration supporting any capability is installed in the application.

The Threat Intelligence Security Center supports Threat Lookup only for the following integrations:

  • VirusTotal
  • CrowdStrike Intelligence

For more information, see Threat Lookup.

About this task

The Threat Lookup section contains only the integrations with the integration type as threat lookup.

This section displays cards for each of the configured integration implementations that you can activate and use.

Procedure

  1. Navigate to Workspaces > Threat Intelligence Security Center.

  2. Select the Integrations icon, and select the Threat Lookup section.

Image omitted: enrich-threatlook.png
Threat Lookup integrations

  1. Select the Configure new enrichment action.

    A pop-up displays the available integrations.

  2. Select an integration from the list of available integrations, and select Select.

    The Create Enrichment Integration page opens with pre-filled details for the selected integration.

Image omitted: enrich-threat-config.png
Select an integration from the list of available integrations

  1. On the Create Integration form, fill in the fields.

    FieldDescription
    NameEnter a name for the new enrichment integration. For example, VirusTotal-1.
    Vendor NameName of the vendor. This field is automatically set to the selected vendor. For example, VirusTotal.
    Integration TypeType of integration. This field is automatically set to Threat Lookup.
    DescriptionEnter a unique description for the new enrichment integration.
Image omitted: enrich-threatlook-new.png
Create enrichment integration form

  1. In the Integration Configuration section, configure the integration details based on your requirements.

    The Integration Configuration section includes configuration details like API key, API Client ID or secret, username, and password. These configuration details vary for different apps.

  2. Select the Save action to store and create the new enrichment integration configuration.

    The system validates the provided details and sets the enrichment integration status to inactive by default.

  3. Select Save as Draft action to only store the updates made to the enrichment configuration and not create it.

    If you aren't sure about the configuration details, you can use the Save as Draft option. After you get the configuration details, you can fill the remaining information in the draft version and create it.

  4. To enable the enrichment integration, select Enable.

    The system enables the enrichment integration. You can also enable, disable, or delete a particular enrichment integration by using the Actions menu of the required integration tile on the Catalog page or the Enrichment Integrations page.

  5. View Threat Lookup Reputation Calculators
    You can view the Threat Lookup Finding Calculator to calculate the observable findings for your integration.

Parent Topic:TISC Enrichment integrations

Related topics

View Threat Lookup Reputation Calculators