Enriching Data with URLScan.io

When activated, the URLScan.io enrichment provides data enrichments for domain and email observables.

You can leverage URLScan.io data on Explore after activation.

URLScan.io enables the following data transformations:

• Email to URL
• Domain to IP
• Domain to URL

You can mouse over returned URLs and IP addresses to view additional fields. Additional fields for IP addresses include ASN, ASN Name, and Country. Additional fields for URLs include Source and Time.

Before activating the URLScan.io enricment, obtain a URLScan.io API Key from your urlscan.io account.

To activate the URLScan.io enrichment:

1. Navigate to ThreatStream > APP STORE > APP Store.

2. Click Get Access on the URLScan.io tile.
3. Click I have credentials on the wizard page that opens.
4. On the next wizard page, click Credentials and then enter your URLScan.io API Key.
5. Click Activate.

The URLScan.io enrichment is now active.