> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Threat Intelligence

> Look up indicators of compromise on demand, and feed your own indicators into Myrmex with CSV, Text, and MISP feeders.

import { CardGroup, Card, Note, Steps, Step, Tip } from '@mintlify/components';

The **Threat Intelligence** tab in Case Management has two jobs: it lets you look up any indicator of compromise on demand, and it manages the **feeders** that bring your own indicators into Myrmex. Both feed the same picture of what's dangerous in your environment.

## Look Up an Indicator

Paste an indicator to get a verdict and the context behind it. The lookup accepts the common IOC types:

* **IP addresses**
* **Domains**
* **File hashes**
* **URLs**

Each lookup is kept in a **history** so you can revisit earlier checks without running them again. Results are backed by [Orion](/documentation/multi-agent-system/orion), Myrmex's threat-intelligence specialist, drawing on sources such as **Google Threat Intelligence** and **VirusTotal**.

<Tip>
  For a deeper, multi-step investigation — attribution, infrastructure mapping,
  breach exposure — ask Orion directly in chat rather than a one-off lookup.
</Tip>

## Bring Your Own Indicators: Threat Feeders

**Threat Feeders** pull indicators you already trust into Myrmex on a schedule. You can create a feeder from three source types:

<CardGroup cols={3}>
  <Card title="CSV" icon="file-csv">
    Load indicators from a structured CSV source.
  </Card>

  <Card title="Text" icon="file-lines">
    Ingest a plain-text list of indicators.
  </Card>

  <Card title="MISP" icon="share-nodes">
    Connect a MISP threat-sharing instance.
  </Card>
</CardGroup>

Once a feeder exists, you manage it from this tab:

<Steps>
  <Step title="Create">
    Add a feeder and point it at your CSV, text, or MISP source.
  </Step>

  <Step title="Activate">
    Turn the feeder on so Myrmex starts collecting from it.
  </Step>

  <Step title="Run & schedule">
    Run a feeder on demand, or set it to refresh on a schedule so new indicators
    arrive automatically.
  </Step>
</Steps>

The indicators a feeder collects surface here in Threat Intelligence, where they enrich your lookups and the SOC investigations you launch from [Alerts](/documentation/detection-response/alerts).

## Related

<CardGroup cols={2}>
  <Card title="Orion" icon="user-secret" href="/documentation/multi-agent-system/orion">
    The threat-intelligence specialist behind lookups and enrichment.
  </Card>

  <Card title="Alerts" icon="bell" href="/documentation/detection-response/alerts">
    Where feeder indicators and lookups meet your live detections.
  </Card>
</CardGroup>