Cyber Security Academy · Lesson

Integrations and Enrichment

Connecting tools and adding context.

Integrations and Enrichment is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Integrations Are the Hard Part

A SOAR platform is only as capable as the tools it can talk to. Integrations (connectors) are the adapters that let a playbook query and command external systems via their APIs.

The visual playbook gets the attention, but the unglamorous integration layer, authentication, rate limits, data parsing, is where most of the engineering effort and most of the breakage lives.

Two Directions of Integration

Integrations flow in two directions:

Inbound (ingestion) — events come into SOAR from SIEM, EDR, email gateway, cloud audit logs. These trigger playbooks.
Outbound (action) — SOAR commands tools: block an IP on the firewall, disable a user in the identity provider, isolate a host in the EDR.

A complete integration usually needs both: receive the event, then act back on the same ecosystem.

What Enrichment Means

Enrichment is adding context to a raw indicator so the next decision is informed. A bare IP address tells you little. Enriched, it becomes:

Geolocation and owning ASN.
Threat-intel reputation score and known campaigns.
Whether it appears elsewhere in your environment.
Whether it is on an allow-list of known-good infrastructure.

Enrichment turns a single artifact into a body of evidence a playbook can branch on.

Common Enrichment Sources

Typical enrichment categories and example sources:

Reputation / threat intel — VirusTotal, AbuseIPDB, your MISP instance.
Internal context — CMDB (who owns this host?), IAM (what can this user access?), asset inventory.
Sandboxing — detonate suspicious files and URLs to observe behavior.
WHOIS / DNS — domain age and registration are strong phishing signals.

Combine internal and external sources; external reputation alone misses the question does this matter to us?

An Enrichment API Call

Here is the shape of a reputation lookup a SOAR enrichment action wraps. The playbook parses the response and stores a normalized score.

GET https://www.virustotal.com/api/v3/ip_addresses/198.51.100.23
x-apikey: $VT_API_KEY

# response (trimmed)
# {
#   "data": { "attributes": {
#     "last_analysis_stats": { "malicious": 7, "harmless": 60 }
#   }}
# }

Normalize Everything

Every tool returns data in its own schema. One reputation API reports a 0-100 score; another reports malicious/suspicious/clean; a third returns raw vendor verdicts.

Before branching, normalize these into a common internal representation. Map each source onto a shared scale or enum so playbook logic does not need to know which vendor answered.

def normalize_vt(resp):
    stats = resp["data"]["attributes"]["last_analysis_stats"]
    total = stats["malicious"] + stats["harmless"]
    pct = (stats["malicious"] / total) * 100 if total else 0
    return {"source": "virustotal", "score": round(pct)}

Authentication and Secrets

Integrations authenticate with API keys, OAuth tokens, or service accounts. Treat these as high-value secrets; a compromised SOAR token can disable accounts and isolate hosts across the fleet.

Store credentials in the platform's secret vault, never in playbook text.
Scope each integration's permissions to the minimum it needs (least privilege).
Rotate tokens and monitor their use; SOAR is a high-privilege actor.

Rate Limits and Caching

Enrichment APIs impose rate limits. A playbook that enriches every artifact on every event will quickly hit them, especially free-tier threat intel.

Mitigations:

Cache enrichment results; an IP's reputation rarely changes minute to minute.
Deduplicate lookups within a case so the same hash is not queried five times.
Respect HTTP 429 with backoff rather than hammering the endpoint.

Handle Partial and Conflicting Data

Sources disagree. VirusTotal may flag an IP malicious while AbuseIPDB shows it clean. Design enrichment to aggregate rather than trust one source blindly.

Common strategies: take the max severity, require N sources to agree before high-confidence action, or weight trusted internal intel above noisy public feeds. Always record which sources contributed to the verdict for later review.

Integration Health Monitoring

A silently broken integration is dangerous: playbooks may proceed on missing data. Monitor connector health actively.

Alert when an API starts returning errors or auth failures.
Track latency; a slow enrichment source stalls the whole playbook.
Watch for schema changes; vendors alter response formats without notice.

Treat integrations as production dependencies with their own SLAs and alerting.

Watch for Enrichment Side Effects

Enrichment is usually safe, but some lookups have side effects you must control. Detonating a URL in a sandbox, or even a naive WHOIS or HTTP fetch, can tip off an attacker that they have been spotted.

Use passive sources (cached intel, passive DNS) before active ones.
For live detonation, route through infrastructure that does not reveal your organization.
Never let an automated enrichment step itself become the trigger that alerts the adversary.

Quick Check

Reason about enrichment design under rate limits.

Recap

Integrations and enrichment essentials:

Integrations are the connectors that ingest events and push actions; they are where most engineering effort and breakage live.
Enrichment adds context (reputation, internal ownership, sandbox results) so playbooks can make informed decisions.
Combine external threat intel with internal context, and normalize all sources into a shared representation.
Protect integration credentials with least privilege and a secret vault; SOAR is a high-privilege actor.
Respect rate limits via caching and dedup, aggregate conflicting sources, and actively monitor integration health.

Frequently asked questions

Is the “Integrations and Enrichment” lesson free?

Yes — the full text of “Integrations and Enrichment” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Integrations and Enrichment”?

Connecting tools and adding context. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Integrations and Enrichment” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cyber Security Academy