AI IoC enrichment in 2026: what actually works

An IoC enrichment pipeline takes a raw indicator (IP, domain, file hash, URL, email address) and attaches context that makes it actionable. Pre-AI enrichment pipelines used rule-based lookups: submit the IP to VirusTotal, AbuseIPDB, and MISP; check if any feed already knows it as malicious; apply a verdict based on vote count. The analyst received a scored verdict but no narrative context.

AI enrichment adds four capabilities that rule-based lookups cannot provide. First, narrative context: the LLM can surface that this IP was used in a 2024 SWIFT-targeting campaign by a Lazarus Group affiliate, pulling from threat reports that mention the IP in prose. Second, cross-feed deduplication: when VirusTotal says malicious, AbuseIPDB says clean, and MISP has conflicting tags, the LLM can reconcile the signals and produce a weighted verdict with explicit uncertainty. Third, MITRE ATT&CK mapping: the LLM can map the enriched indicator to TTPs and techniques without manual analyst effort. Fourth, confidence-scored output: a well-prompted enrichment agent can output structured STIX with an explicit confidence level and the data sources behind it.

The TLP protocol governs how enriched intelligence can be shared. Most AI enrichment tools in 2026 produce TLP-AMBER output by default, requiring human review before the enriched indicator is promoted to TLP-WHITE for broader sharing. This is correct. Do not deploy enrichment pipelines that auto-share attribution above TLP-GREEN without human review.

Research context: TAM-Eval (2024) tested LLM threat-actor attribution accuracy on a standardised IoC set and found accuracy rates of 60-75% on well-documented actors (where training data was rich) dropping to 30-45% on less-documented actors. MuTAP research on LLM-generated malware indicators documented similar hallucination rates on specific byte patterns. Mandiant's own false-positive disclosures in their Gemini-in-TI documentation warn explicitly that attribution outputs require human verification.

Mandatory mitigation patterns for production enrichment pipelines:

1. 1.Require cited sources: every enrichment output must reference the source data that grounds the attribution claim. If the LLM cannot cite a source, the attribution is rejected.
2. 2.Require confidence score with explicit low-data acknowledgement: the enrichment output must include a confidence level (High/Medium/Low) and, for Low, an explicit statement that the evidence base is insufficient for reliable attribution.
3. 3.Never auto-block on enrichment-only signal: enrichment output is advisory, not actionable, until confirmed by a second source or human review. Auto-block workflows must have a second-source gate.
4. 4.Human-in-the-loop on attribution above Medium confidence: Medium and above attribution claims go to analyst review queue before the enriched indicator propagates to block lists, SIEM rules, or sharing feeds.
5. 5.Feedback loop: track enrichment outputs against human-analyst verdicts. Build a false-positive rate dashboard per enrichment tool. Set an SLA for improving tools that fall below 70% accuracy on attribution.

The MISP + Cortex + LLM orchestrator pattern, verified working as of April 2026:

# OSS enrichment pipeline (April 2026)

1. MISP  <-- pulls from:
   - CIRCL OSINT feed (daily)
   - abuse.ch (URLhaus, MalwareBazaar, ThreatFox) (hourly)
   - AlienVault OTX (daily)
   - CISA KEV watchlist (daily)

2. MISP emits event --> Cortex (via webhook)

3. Cortex fires analysers per new indicator:
   - VirusTotal (hash, IP, domain, URL)
   - AbuseIPDB (IP)
   - URLscan.io (URL, domain)
   - Shodan (IP)
   - Greynoise (IP)
   - crt.sh (domain - cert transparency)
   - BGPview (IP - ASN context)
   - WhoisXML (domain - WHOIS history)

4. LLM agent (Claude Sonnet / GPT-5 via MCP):
   - reads Cortex output (JSON)
   - synthesises enrichment note
   - maps to MITRE ATT&CK TTPs
   - assigns confidence (H/M/L)
   - writes STIX-formatted note back to MISP

5. Human analyst reviews in MISP dashboard
   - Approve: indicator promotes to block list feed
   - Reject: logged with reason for feedback loop

Infrastructure: Cortex requires approximately 4 vCPU / 8GB RAM per 100 concurrent analyser threads. MISP single-instance on 8 vCPU / 32GB RAM handles moderate volume. LLM API cost at typical SOC enrichment volumes (500-2,000 indicators per day): $500-$1,500 per month using Claude Sonnet 4.5 or equivalent. Full stack on Hetzner: approximately $400-$800 per month. See open-source tools for the complete stack walkthrough.

For teams that want commercial data depth without Recorded Future Elite pricing, the hybrid pattern works well: Recorded Future Core feeds (commercial data depth) plus OpenCTI as the knowledge graph (STIX-native, modern UX) plus an LLM orchestrator for enrichment synthesis plus TheHive for case management.

Cost comparison at typical mid-market scale (8 analysts, 1,000 indicators/day):

Use the ROI calculator to model your specific team size and indicator volume against these architectures.