The problem

Analysts triaging alerts repeat the same loop all day: take an indicator, check it against threat-intel sources, and make a keep-or-escalate call. Doing that by hand through web consoles is slow and inconsistent — two analysts can reach different verdicts on the same IP.

The approach

1. 01Auto-classifies the indicator — IP, domain, or file hash (MD5/SHA1/SHA256) — so the operator never picks a lookup mode.
2. 02Queries VirusTotal v3 and AbuseIPDB v2 in parallel, then aggregates both into one verdict: CLEAN, SUSPICIOUS, MALICIOUS, or UNKNOWN.
3. 03Batch mode processes a file of indicators with a configurable delay to respect free-tier rate limits.
4. 04Exit codes (0 clean / 1 suspicious-or-malicious / 2 input error) let scripts and CI pipelines gate automated decisions on the result.
5. 05Test suite mocks every API response with unittest.mock — the whole suite runs with no network and no real keys.

Demonstrates

• IoC investigation
• Threat-intel enrichment
• Verdict logic with one-way escalation
• Scripting for SOC workflows