Enrich and pivot on indicators of compromise — resolve context, infrastructure, and relationships, assess confidence and relevance, and decide block vs. monitor. Use to add analytic value to raw IOCs from an incident, feed, or hunt.
