Who should use the Cybersecurity Threat Intelligence and Monitoring workflow?
Teams or solo builders working on security tasks who want a repeatable process instead of one-off tool experiments.
AI Workflow · Security
Leverage Criminal IP for comprehensive threat hunting, attack surface management, and fraud detection to protect your organization's digital assets.
Deliverable outcome
A closed-loop intelligence cycle with actionable reports and an improved threat model for ongoing protection.
30-90 minutes
Includes setup plus initial result generation
Free to start
You can swap tools by pricing and policy requirements
A closed-loop intelligence cycle with actionable reports and an improved threat model for ongoing protection.
Use each step output as the input for the next stage
Step map
Instead of relying on a single generic AI model, this pipeline connects specialized tools to maximize quality. First, you'll use Criminal IP to a documented threat profile and monitoring scope that guides all subsequent hunting and detection activities. Then, you pass the output to Criminal IP to a prioritized list of compromised or high-risk ips and domains with validated threat context. Then, you pass the output to Criminal IP to a complete, up-to-date attack surface map with automated alerts for any changes or new exposures. Then, you pass the output to Criminal IP to a list of fraudulent domains and infrastructure with evidence for takedown requests and brand protection escalation. Then, you pass the output to Splunk to a prioritized incident queue with correlated threat intelligence ready for response actions. Then, you pass the output to Exabeam to automated containment of verified threats with full audit trail for compliance. Finally, Onyx AI (formerly Danswer AI) is used to a closed-loop intelligence cycle with actionable reports and an improved threat model for ongoing protection.
Define Threat Profile and Monitoring Scope
A documented threat profile and monitoring scope that guides all subsequent hunting and detection activities.
Initial Threat Hunting and IP Reputation Analysis
A prioritized list of compromised or high-risk IPs and domains with validated threat context.
Attack Surface Discovery and Continuous Asset Monitoring
A complete, up-to-date attack surface map with automated alerts for any changes or new exposures.
Fraud Detection and Brand Protection Analysis
A list of fraudulent domains and infrastructure with evidence for takedown requests and brand protection escalation.
Threat Correlation and Incident Prioritization
A prioritized incident queue with correlated threat intelligence ready for response actions.
Automated Response and Remediation Playbook Execution
Automated containment of verified threats with full audit trail for compliance.
Reporting and Intelligence Feedback Loop
A closed-loop intelligence cycle with actionable reports and an improved threat model for ongoing protection.
Identify your organization's critical assets (domains, IP ranges, cloud services, brand keywords) and prioritize threat categories (malware, phishing, DDoS, fraud). Document the scope in a threat model to guide all subsequent steps.
Why Criminal IP: Criminal IP directly provides IP Reputation Analysis and Attack Surface Discovery, which are core to defining the threat profile and monitoring scope. It also has a Criminal IP account requirement listed in the step needs.
Use Criminal IP's threat intelligence feeds to scan your own IPs and domains for known malicious indicators (blacklists, malware associations, open ports). Cross-reference results with external threat feeds to identify compromised or suspicious assets.
Why Criminal IP: Criminal IP is explicitly needed for its API and IP Reputation Analysis, and it directly supports threat hunting with threat intelligence feeds like OTX and VirusTotal.
Deploy automated scans to discover unknown or shadow IT assets (subdomains, cloud instances, expired certificates) using Criminal IP's discovery tools. Set up continuous monitoring for changes in asset configurations, new open ports, or certificate anomalies.
Why Criminal IP: Criminal IP has Attack Surface Discovery as a core capability, directly matching the step's need for attack surface monitoring and continuous asset discovery.
Search for phishing domains, typosquatted URLs, and fake social media accounts impersonating your brand using Criminal IP's domain and IP intelligence. Analyze hosting infrastructure of fraudulent sites to identify and takedown threat actors.
Why Criminal IP: Criminal IP supports domain search and IP reputation analysis, which are key for fraud detection and brand protection analysis alongside WHOIS and credential leak databases.
Aggregate all findings from previous steps into a single dashboard. Use correlation rules (e.g., same IP appearing in both phishing and malware feeds) to identify high-priority incidents. Assign severity scores based on asset criticality and threat confidence.
Why Splunk: Splunk is a leading SIEM platform explicitly listed in the step needs, and it provides Security Monitoring, Threat Detection, and Incident Response for correlation and prioritization.
Trigger automated actions for high-confidence threats: block malicious IPs via firewall API, revoke compromised certificates, or send takedown notices to hosting providers. Document each action for compliance and post-incident review.
Why Exabeam: Exabeam provides Automated Incident Response, which directly supports executing remediation playbooks and integrating with ticketing systems and firewall APIs.
Generate executive summaries and detailed technical reports on threat trends, response effectiveness, and residual risk. Feed lessons learned back into the threat profile and monitoring scope to continuously improve coverage.
Why Onyx AI (formerly Danswer AI): Onyx AI provides enterprise knowledge search and AI-powered Q&A over company data, which is ideal for creating a documentation wiki and feeding intelligence back into the threat model.
§ Before you start
Teams or solo builders working on security tasks who want a repeatable process instead of one-off tool experiments.
No. Start with the top pick for each step, then replace tools only if they do not fit your pricing, compliance, or output needs.
Open the mapped task page and compare top options side by side. Prioritize output quality, integration fit, and predictable cost before scaling.
§ Related
Track competitor moves and market shifts in real-time with automated intelligence gathering — so you always know what your rivals are doing.
Connect siloed business applications into a unified, AI-managed operational pipeline that eliminates manual handoffs between systems.
Analyze portfolios, backtest investment strategies, and receive AI-generated market signals — giving individual investors access to institutional-grade tools.