What this endpoint does

Performs batch risk enrichment for up to 1,000 indicators across six types: IP addresses, domains, URLs, file hashes, CVE identifiers, and companies. Submit indicators grouped by type: {"ip": [...], "domain": [...], "url": [...], "hash": [...], "vulnerability": [...], "company": [...]} — include only keys for types you are submitting. For automated triage with threshold-based verdicts, use SOAR: Triage Batch instead.

Response data

Returns risk intelligence for each submitted indicator — both an overall risk assessment and context-specific sub-scores for malware, phishing, C2, and public threat categories. The context sub-scores are the same ones the triage endpoint uses to calculate verdicts, so use this endpoint when you want raw scores for custom decision logic rather than a binary yes/no verdict. Each indicator's triggered risk rules include evidence summaries explaining why the rule fired, which is valuable for analyst review and incident documentation. Indicators with no known risk return a score of 0 with empty rule summaries. The level field (0.0–5.0) provides a coarser severity rating than the 0–99 score.