Criminal Ip And Palo Alto Networks Cortex Xsoar Integrate To Bring...

Criminal IP (criminalip.io), the AI-powered threat intelligence and attack surface monitoring platform developed by AI SPERA, is now officially integrated into Palo Alto Networks’ Cortex XSOAR.

The integration embeds real-time external threat context, exposure intelligence, and automated multi-stage scanning directly into Cortex XSOAR’s orchestration engine, giving security teams higher incident accuracy and faster response than conventional log-centric approaches.

For Palo Alto Networks, widely regarded as the global leader in cybersecurity, Cortex XSOAR is a central hub for SOC automation. With Criminal IP added as an integration through the Cortex Marketplace,

Cortex XSOAR can now offer users the ability to evaluate suspicious IPs and domains not only through static reputation data but also through behavioral signals, exposure history, infrastructure correlations, and AI-driven threat scoring, without requiring additional systems or analyst-driven lookups.

Modern SOC teams face overwhelming alert volumes, yet traditional enrichment still depends on static reputation feeds with limited context, often missing port exposure, CVE ties, certificate reuse, DNS changes, or anonymization behavior.

Criminal IP fills this gap by continuously analyzing global internet-facing assets and correlating IP behavior, domain activity, SSL/TLS data, port states, CVE exposure, IDS hits, and masking indicators.

When an alert includes an IP or domain, Cortex XSOAR can automatically pull this enriched intelligence into the active incident via a playbook, allowing analysts to assess intent and severity without leaving Cortex SOAR.

Access Criminal IP's Threat Intelligence needed to proactively identify, analyze, and respond to emerging threats.

Powered by AI and OSINT, it delivers threat scoring, reputation data, and real-time detection of a wide array of malicious indicators, ranging from C2 servers and IOCs to masking services like VPNs, proxies, and anonymous VPNs, across IPs, domains, and URLs. Its API-first architecture ensures seamless integration into security workflows to boost visibility, automation, and response.

Cortex XSOAR playbooks can trigger Criminal IP’s automated three-stage scanning workflow: beginning with a Quick Lookup, escalating to a Lite Scan, and then performing a Full Scan for complete attack surface analysis.

Source: BleepingComputer