# Threat IOC Enrichment

> Threat IOC Enrichment is a paid API for AI agents from payai.agentstools.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-11).

Auto-detects and enriches any indicator of compromise (hash, IP, domain, URL, or CVE) with a normalized threat-intelligence verdict, confidence score, and per-source citations.

## Facts

- Endpoint: GET https://payai.agentstools.dev/threat/ioc?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/threat-ioc-enrichment-d6eeb23b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_cfbqudHlAD4MoxN6PTYpZ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability threat-ioc-enrichment-d6eeb23b
```

Example prompt: Can you check if the IP address 185.220.101.45 is malicious? I need a threat-intelligence verdict with confidence score and which sources flagged it.

## When to prefer this

Use this endpoint when you need a single, fused, source-cited threat verdict for any IOC type without having to route to separate hash, IP, domain, or CVE lookup services. Ideal for SOC automation, DFIR playbooks, and alert-enrichment pipelines where speed, normalization, and multi-source fusion matter more than deep drill-down per source. Prefer this over single-source tools when you want a confidence-weighted verdict rather than raw, uninterpreted feed data.

## Known failure modes

- Unrecognized or malformed indicator format returns an error — ensure hash length matches MD5/SHA1/SHA256 standards
- Unknown or very new IOC may return low confidence with no malware family
- CVE IDs must follow standard format (CVE-YYYY-NNNNN) or auto-detection may fail
- Rate limiting or upstream source unavailability may degrade confidence or citation count
- Ambiguous indicators (e.g. short strings that could be multiple types) may be misclassified without a type override

## How this service works

Type-agnostic threat-intelligence enrichment for a SOC or DFIR agent. Give one indicator of compromise of any kind — a file hash, IP, domain, URL or CVE id — and get one normalized, cited verdict. Auto-detects the type, dispatches to the right grain, fuses the sources and returns a verdict, an is_malicious flag, a confidence, malware family when known, per-source citations and reasons. Not a guarantee.

## Output

A normalized threat-intelligence response containing: a human-readable verdict string, an is_malicious boolean flag, a confidence score (0–1), the detected IOC type, the malware family if identified, and per-source citations each including the source name, its individual verdict, and the reason or evidence it provided. The result is aggregated from multiple threat-intelligence sources.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "indicator"
     ],
     "properties": {
      "type": {
       "enum": [
        "md5",
        "sha1",
        "sha256",
        "hash",
        "ip",
        "ipv4",
        "ipv6",
        "domain",
        "url",
        "cve"
       ],
       "type": "string",
       "description": "Optional type override; auto-detected if omitted"
      },
      "indicator": {
       "type": "string",
       "description": "The indicator of compromise: a file hash (md5/sha1/sha256), IP, domain, URL or CVE id"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/threat-ioc-enrichment-d6eeb23b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from payai.agentstools.dev](https://www.zero.xyz/host/payai.agentstools.dev/llms.txt)