Threat Intelligence

wisdom_lookup asks AlphaSOC Wisdom what is known about one external indicator, a domain or an IP address, and returns its threat-intelligence flags, how prevalent it is across the environments AlphaSOC monitors, and, for domains, when it was registered.

The distinction from the tools that read your own data is the one thing to get right, because they are easy to confuse from the names alone:

Question	Tool
"Is evil.example.com malicious?"	wisdom_lookup
"Did anything fire on evil.example.com?"	findings_summary
"Was evil.example.com in our logs at all?"	lake_search

Wisdom is AlphaSOC's own threat-intelligence service. It knows about indicators across the wider internet, but nothing about your telemetry; the data tools read your own findings and observations, and know nothing about the wider internet. Most real investigations use both sides, in that order.

That intelligence goes well beyond third-party blocklists. Wisdom also runs classifiers AlphaSOC has built and refined over the years, among them active fingerprinting of suspicious infrastructure and brand impersonation detection, and applies them to indicators in real time.

Requires an active Wisdom license and the Guest role or above in the workspace.

Looking up an indicator

Lookups take one indicator at a time: a domain name, or an IPv4 or IPv6 address. An address can be qualified by transport protocol and destination port when you have them from a finding, since intelligence about a specific service is more useful than intelligence about the address in general.

An answer has three parts. Flags are the adverse evidence Wisdom holds, each labelled with what it saw: the malware family behind a C2 callback, or the brand a domain impersonates. The vocabulary is documented at Wisdom Flags. Prevalence is how widely the destination is seen across the environments AlphaSOC monitors, and low values deserve attention: a destination almost nobody reaches is a hallmark of targeted activity. For domains, the registration date completes the picture; a freshly registered domain is a warning sign on its own.

Examples

Triage an unfamiliar destination

Look up cdn.example-tracker.net in Wisdom and tell me whether it justifies escalating.

One lookup says whether it is known C2 infrastructure with a named malware family, commodity traffic that many hosts reach, or unknown to Wisdom entirely. That is often the difference between paging someone and closing the ticket.

Qualify an address by protocol and port

Is 203.0.113.10 known to Wisdom? It was contacted over TCP on port 4444.

Mentioning the transport and port narrows the answer to intelligence about that service; leave them out and you get everything known about the address.

Check a domain from a phishing report

Someone forwarded a phishing mail linking to secure-login-alphasoc.example. Look it up and tell me whether it impersonates one of our brands.

Enrich a short list of indicators

Here are eight destinations from last night's findings. Look each one up and group them by whether Wisdom flags them.

Each lookup is an independent call, so working through a list is fine. Keep it modest, though: the rate limit assumes interactive use, not bulk enrichment.

Pivot from intelligence back to telemetry

Once Wisdom confirms an indicator is bad, the follow-up question is always local: who talked to it, and when. That is a Findings & Telemetry question, and asking both sides in one conversation is the point of having both:

Wisdom flags 203.0.113.10 as C2. Now search our findings from the last 7 days for anything involving that address, and list the hosts.