Threat Assessment for an Indicator
explain_indicatorRun a comprehensive threat assessment on any indicator: IPv4, IPv6, hostname, CIDR, or ASN. Returns threat level, score, explanation, and contributing factors with sources.
Instructions
Run a comprehensive threat assessment on a single indicator. The indicator can be an IPv4, IPv6, hostname, CIDR network, or ASN - the procedure auto-detects the type.
Returns a single structured row: { indicator, type, available, cached, found, score, level (NONE/INFO/LOW/MEDIUM/HIGH/CRITICAL), explanation, factors[], sources[] }. For ASN inputs the row also includes a breakdown object with composite sub-scores (threatDensityScore, graphMetricsScore, historicalScore, prefixAgeScore). For CIDR inputs the explanation field carries threat-density stats (listed IPs, density %).
Prefer this tool over manual ASN→PREFIX→IP→LISTED_IN walks - those time out on large ASNs (AWS, GCP, Azure, Cloudflare). Performance: 3-25ms for IP/domain/network, up to ~80ms for ASN.
Argument: indicator (string, required). Allowed characters: letters, digits, '.', '-', ':', '/', '_'. Cypher-special characters are rejected.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| indicator | Yes | IPv4 / IPv6 / hostname / CIDR / ASN. Examples: "185.220.101.1", "google.com", "3.64.0.0/12", "AS13335". |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| rows | Yes |