Security teams increasingly expect threat intelligence to work inside the platforms they already use. Analysts should not need to leave a SIEM, SOAR, or threat intelligence platform whenever they need to validate an IP address, investigate a suspicious domain, or understand the infrastructure behind an alert.
Criminal IP supports a broad integration ecosystem spanning cybersecurity platforms, threat intelligence services, cloud marketplaces, and security operations tools. Rather than covering every available integration, this article focuses on three recent additions: Palo Alto Networks Cortex XSOAR, IBM QRadar, and Securonix ThreatQ.
Each integration applies Criminal IP intelligence at a different stage of the security workflow. Cortex XSOAR focuses on automated investigation and response, IBM QRadar brings external context into SIEM and SOAR operations, and ThreatQ strengthens intelligence enrichment, relationship analysis, and prioritization.
Together, these integrations show how Criminal IP is moving beyond standalone searches and delivering external threat and exposure intelligence directly into operational security environments.
Automating Investigation and Response with Cortex XSOAR
The Criminal IP integration with Palo Alto Networks Cortex XSOAR brings external infrastructure intelligence into automated incident-response playbooks.
Traditional enrichment often relies on static reputation data that provides only a limited view of an IP address or domain. This can leave out important context such as exposed ports, vulnerable services, SSL certificate relationships, DNS changes, anonymous infrastructure, and historical malicious activity.
Through the Criminal IP integration, Cortex XSOAR can automatically retrieve this context when a suspicious IP address or domain appears in an incident. Analysts can review maliciousness indicators, infrastructure relationships, exposure history, known vulnerabilities, and anonymization signals without leaving the Cortex XSOAR environment.
The integration also supports a multi-stage scanning workflow. A playbook can begin with a Quick Lookup, escalate to a Lite Scan, and proceed to a Full Scan when deeper analysis is required. Full Scan results are returned as structured reports, while automated polling allows the investigation to continue without repeated analyst input.
This process enables security teams to move from an initial indicator to a broader understanding of the infrastructure behind it. Rather than evaluating an IP address or domain as an isolated data point, analysts can determine whether it is connected to exposed services, malicious infrastructure, or a wider attack operation.
Adding External Threat Context to IBM QRadar
The Criminal IP integration with IBM QRadar applies threat intelligence across both SIEM monitoring and SOAR response workflows.
Within QRadar SIEM, IP addresses observed in firewall traffic logs can be analyzed through the Criminal IP API. The resulting intelligence is displayed directly inside the SIEM environment, allowing security teams to assess inbound and outbound communications according to external threat risk.
Observed IP addresses can be classified into High, Medium, or Low risk categories. This gives SOC teams an additional layer of context for identifying suspicious traffic and determining which events should be investigated or escalated first.
The integration also supports interactive investigation. Analysts can open a detailed Criminal IP report directly from QRadar Log Activity and review threat indicators, historical behavior, external exposure, and infrastructure characteristics without switching tools.
QRadar SOAR extends this capability through prebuilt playbooks for IP addresses and URLs. Enrichment results can be returned to the case as artifact hits or incident notes, allowing Criminal IP intelligence to become part of the incident-response process rather than remaining a separate reference source.
By combining QRadar’s internal telemetry with Criminal IP’s external infrastructure intelligence, organizations can evaluate alerts with greater context and reduce the time required for manual investigation.
Strengthening Intelligence Operations in Securonix ThreatQ
The Criminal IP integration with Securonix ThreatQ is designed for organizations that manage and operationalize intelligence from multiple sources.
ThreatQ centralizes threat data and allows security teams to evaluate, prioritize, and investigate indicators within a unified environment. Criminal IP adds continuously updated external context covering IP maliciousness, VPN and proxy use, remote access exposure, open ports, known vulnerabilities, and related infrastructure.
Using ThreatQ’s orchestration capabilities, incoming IP indicators can be evaluated automatically against Criminal IP intelligence. This keeps enrichment data current while reducing the need for analysts to perform repeated manual lookups.
Analysts can also access Criminal IP data directly from indicator detail views and investigation boards. This makes it possible to validate suspicious activity during an active investigation without leaving the ThreatQ workspace.
The integration further supports infrastructure relationship analysis. Criminal IP data can reveal connections between IP addresses, exposed services, associated infrastructure, and attack activity, while ThreatQ’s investigation graph helps analysts visualize those relationships.
This provides greater value than a simple malicious-or-benign classification. Analysts can understand why an indicator matters, how it may connect to other infrastructure, and whether it should receive a higher operational priority.
One Intelligence Layer Across SIEM, SOAR, and TIP
Although the three integrations serve different platforms, they share the same objective: applying external threat intelligence at the point where security decisions are made.
Cortex XSOAR uses Criminal IP data to automate investigation and response. IBM QRadar applies it to traffic analysis, alert enrichment, interactive investigation, and SOAR workflows. Securonix ThreatQ uses the intelligence to strengthen indicator validation, relationship analysis, and prioritization.
Together, they demonstrate how the same external infrastructure context can support different stages of the security lifecycle. Threat intelligence can inform initial detection in a SIEM, guide automated investigation in a SOAR platform, and support deeper analysis within a threat intelligence platform.
This reduces the gap between observing a suspicious indicator and deciding what action to take. Analysts can access relevant context within the systems where they already investigate alerts, manage intelligence, and coordinate response actions.
Expanding the Criminal IP Integration Ecosystem
The three integrations covered in this article represent only part of the broader Criminal IP ecosystem. Criminal IP is also available across a range of security products, cloud environments, marketplaces, and intelligence services.
As attack infrastructure becomes more distributed and rapidly changing, organizations need intelligence that can be delivered directly into their existing products and workflows. Search remains valuable for individual investigations, but API-based enrichment and native platform integrations make it possible to apply the same intelligence consistently and on a scale.
Criminal IP continues to expand this ecosystem so that external exposure data, infrastructure relationships, and threat context can support decisions across detection, investigation, prioritization, and response.
Organizations and security vendors interested in integrating Criminal IP intelligence into their products, platforms, or operational workflows can contact the Criminal IP team to discuss available technical integration and ecosystem collaboration options.
Explore Criminal IP integration opportunities:
https://www.criminalip.io/about/partners/tech
Related Categories