Threat intelligence providers
Indicators found during collection (IP addresses, domains, URLs, file hashes) are looked up against the providers you enable. Keys are optional; without them the indicator is shown as not checked, never as clean.
Where keys go
- Settings > Threat Intelligence, with an investigation open. The keys are stored per investigation, encrypted, so two cases run by two teams can use two sets of keys. With no investigation open the tab says Open an investigation to configure its threat intel providers.
- Setting them needs Choose threat intel providers for an investigation (IR lead and Admin by default).
- Badges on a provider card: Free on URLhaus, MalwareBazaar and ThreatFox, whose key field is marked optional; Key Set when a key is stored and readable; a red Key Unreadable with the error in a tooltip when the stored key could not be decrypted (not the same as the provider rejecting it). A provider with no key shows no badge.
- The card takes the key only. The rate limits in the table are defaults; they can be changed through the API, not on the tab.
- Enrichment runs automatically after a collection and after an event log upload. To re-run it for one indicator, expand its timeline event and press Enrich; the PCAP analysis panel has the same button.
Providers
| Provider | Looks up | Default limits CICADA applies |
|---|---|---|
| VirusTotal | Hashes, domains, URLs, IPs | 4 per minute, 500 per day, 10 s timeout (the public API tier) |
| AbuseIPDB | IP addresses | 1000 per day, 5 s timeout |
| IPinfo | IP geolocation and network | 50 per minute, 3 s timeout |
| Shodan | IP exposure; domains through DNS resolution | 60 per minute, 100 per day, 5 s timeout |
| CrowdStrike (Falcon Intelligence) | Indicators | 10 per minute, 5000 per day, 10 s timeout |
| URLhaus (abuse.ch) | URLs, domains and IPs | 10 per minute, 5 s timeout |
| MalwareBazaar (abuse.ch) | File hashes | 10 per minute, 5 s timeout |
| ThreatFox (abuse.ch) | IPs, domains, URLs, hashes | 10 per minute, 5 s timeout |
- The three abuse.ch providers: the backend's notes say abuse.ch has required an Auth-Key since June 2024, but the form marks the key optional and CICADA sends one only when it is set. Nobody has settled which is right with a keyless lookup. Get a key from the abuse.ch portal and paste it; then the question does not arise.
- OTX AlienVault is not a lookup provider in the current release. CICADA builds an OTX link for an indicator; today those vendor links are shown on the PCAP analysis panel only.
- Rate limits are per investigation. Staying under a provider's free tier is your responsibility.
- Outbound HTTPS to each provider is listed on Network Requirements. In an air-gapped deployment leave every provider disabled.
What "not in our list" means now
MalwareBazaar, URLhaus and AbuseIPDB answer not in our list for an indicator they have never seen. That answer now counts as unknown, not clean. An indicator is marked clean only when a provider says so. Earlier releases cleared an indicator because one provider had never heard of it; that no longer happens.
The three enrichment states
An indicator with no reputation can be in three different situations, and CICADA shows which:
| Badge | Meaning | What to do |
|---|---|---|
| Not checked | Enrichment never ran for this indicator: no provider enabled for its type, no key, or the lookup has not happened yet. | Enable a provider that covers the type and re-run enrichment. |
| Check failed | Enrichment ran and every provider failed. The per-provider errors (a 401, a rate limit, a timeout, an unreadable key) are in the badge's tooltip and listed under the badge on the expanded timeline event. | Read the error. A 401 is the key; a 429 is the rate limit; a timeout is the network or proxy. |
| Checked, no verdict | Enrichment ran, at least one provider answered, and nobody had a reputation for it. | Nothing. The indicator is unknown, not clean. |
A completed check with a real level shows the level instead: malicious, suspicious or clean; a provider answer of unknown shows as Checked, no verdict. The badges appear on timeline rows that carry an indicator. Blast-radius analysis treats a node with no verdict as not assessed, never as unaffected.