threat-intel-integrator

Threat intelligence feed integration in LimaCharlie uses API-based lookups and custom feeds to attach context to detection events like CODE_IDENTITY and NETWORK_CONNECTIONS. The Lookup Manager automatically syncs feeds to enrich events with actionable metadata.

Custom threat lookups enrich NETWORK_CONNECTIONS and HTTP_REQUEST detections by validating indicators against API-based feeds. This multi-source validation attaches contextual threat intelligence data directly to detection events for better decision support.

Lookup Manager handles auto-syncing threat intelligence feeds and applying metadata enrichment across detection events. It streamlines API-based lookups so detections like CODE_IDENTITY receive continuous threat context without manual feed updates.

API-based lookups require a YAML frontmatter with name and description fields, plus a Markdown body containing runtime instructions. Optional resources directories support the configuration, enabling enrichment workflows across detection events.

Multi-source validation is supported through built-in API integrations with major threat intelligence providers and custom feeds. Lookup-based enrichment cross-references multiple sources to attach verified context to detection events.

Custom threat feeds are used when built-in API integrations with major TI providers do not cover proprietary indicators. They apply lookup-based enrichment to attach specialized context to detections, extending coverage beyond standard feeds.