Data enrichment

Suricatavel can automatically enrich events with threat intelligence data from external providers. This enriches security alerts with contextual threat intelligence.

How it works

When an event is ingested (e.g., a Suricata alert containing a source or destination IP), Suricatavel:

1. Extracts IOCs: Parses IPs, domain names, and URLs from the raw payload.
2. Checks cache: Looks up the local cache to see if the artifact has been enriched recently.
3. Dispatches jobs: If uncached, it groups the enrichment requests and distributes them asynchronously to active providers.
4. Applies rate limits: Respects your configured subscription limits to prevent API key blocking.

Tip

Deferred SIEM forwarding: You can configure your SIEM destinations to wait for enrichment to complete before forwarding. This guarantees that your downstream SIEM logs will arrive with IP reputation, port scans, and geo-data.

Supported providers

Suricatavel integrates with 9 threat intelligence and infrastructure scanning services:

• AbuseIPDB: Crowdsourced IP abuse reporting and threat score evaluations.
• VirusTotal: Scans files, domains, and IPs against over 70 antivirus engines.
• Shodan: Queries public port, service banner, and device configuration profiles.
• Censys: Direct infrastructure intelligence on open ports, certificates, and host configurations.
• AlienVault OTX: Correlates IPs and domains with Open Threat Exchange community pulses.
• GreyNoise: Filters out internet background scanner noise, labeling benign vs. targeted traffic.
• UrlHaus: Feeds of malicious URLs distributing malware and active payloads.
• GeoIP: Maps IP addresses to physical coordinates, ISPs, and ASN numbers (MaxMind).
• Whois: Queries domain registration ownership and age metadata.

---

Configuration

To enable enrichment, configure API keys and active statuses for your chosen providers:

1. Log in to the Suricatavel Admin Panel.
2. Navigate to Administration > Settings (or the Settings page).
3. Select the Enrichment tab.
4. Enter your API keys and select your Plan (Free / Premium) to apply the corresponding rate limit policies.
5. Click Save.

---

Diagnostics and monitoring

To inspect the health and performance of your enrichment services directly from the CLI, run the following command to check active providers, cache counts, and rate limit configurations:

php artisan suricatavel:providers-status