Evaluate up to 1,000 indicators against a specific risk context (malware, phishing, or c2) and return a boolean verdict based on context-specific sub-scores.
What this endpoint does
Performs automated triage on up to 1,000 indicators by evaluating them against a specific risk context: malware, phishing, or c2. Discover valid {context_name} values and default thresholds from SOAR: Get Contexts. Submit indicators grouped by type: {"ip": [...], "domain": [...], "url": [...], "hash": [...], "vulnerability": [...], "company": [...]}. Returns a boolean verdict based on context-specific sub-scores (not overall risk scores) compared against the threshold. Override defaults with threshold and threshold_type query parameters. For raw enrichment without verdict logic, use SOAR: Enrich.
Response data
Returns a binary triage verdict — the core output is whether the batch of indicators should be considered malicious for the specified threat context. The verdict evaluates context-specific sub-scores (not overall risk scores) against the threshold: with the default max threshold type, any single indicator exceeding the threshold triggers a true verdict; with min type, all indicators must exceed it. The response also includes per-entity enrichment identical to the SOAR: Enrich endpoint, so you get both the automated decision and the underlying intelligence in one call. Use this for SOAR playbook automation where you need a go/no-go decision, and the enrich endpoint when you need scores for custom logic.