SOCRadar XTI

Enrich IPs, domains, URLs & hashes with SOCRadar threat intel as JSON or STIX 2.1, add to Company Pocket, plus malware analysis.

SOCRadar XTI brings SOCRadar threat intelligence right into your browser, so you can enrich indicators without breaking your investigation flow. Select or hover any IP, domain, URL, or file hash on a page and instantly get a verdict, risk score, and the context behind it — pulled from your own SOCRadar account. A side panel collects every indicator on the page for fast bulk triage, and an optional Malware Analysis module lets you submit URLs, files, or hashes to the SOCRadar sandbox and read the results without leaving the tab. WHAT YOU CAN DO • Enrich IPs, domains, URLs, and file hashes in context — via right-click, a selection chip, or auto-highlight. • See verdict, risk score, and supporting details (geolocation, ASN, DNS, tags, related threats) at a glance. • Collect every indicator on a page into a side panel, enrich in bulk, then copy or export to CSV. • Optional Malware Analysis: submit a URL, file, or hash to the SOCRadar sandbox and view structural and dynamic results, screenshots, and email/attachment verdicts. • Works on any http(s) page you investigate — SIEM consoles, ticketing systems, reports, threat feeds, and webmail. HOW IT WORKS SOCRadar XTI uses YOUR OWN SOCRadar API access. Add your SOCRadar IOC Enrichment API key (and, if you use it, your Malware Analysis API key) in the extension's Options. Each module can be enabled independently. No third-party servers are involved — the extension talks only to SOCRadar's API on your behalf. REQUIREMENTS • A SOCRadar account with API access (IOC Enrichment and/or Malware Analysis). PRIVACY The extension only sends the indicators you choose — and, for the malware module, the URLs/files/hashes you submit — to SOCRadar's API using your key. Your API keys are stored locally in your browser. Privacy policy: https://socradar.io/privacy-policy/ SOCRadar, the SOCRadar logo, and "XTI" are trademarks of SOCRadar.