> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Orion

> Threat intelligence & reconnaissance — IOC, domain, and IP-reputation analysis, threat investigations, and email-exposure checks.

import { CardGroup, Card, Note } from '@mintlify/components';

**Orion** is the threat intelligence and reconnaissance specialist. When you need to know whether something is dangerous — an indicator of compromise, a domain, an IP address, an email — Orion investigates it and tells you what it found and how concerned you should be.

## What Orion Investigates

<CardGroup cols={2}>
  <Card title="Indicators of compromise" icon="fingerprint">
    Analyze and correlate IOCs — hashes, IPs, domains, URLs — to determine whether
    they're tied to known threats.
  </Card>

  <Card title="Domain & IP reputation" icon="globe">
    Check the reputation and registration details of domains and IP addresses, and
    map the infrastructure behind them.
  </Card>

  <Card title="Threat investigations" icon="user-secret">
    Investigate suspected threats and attribute activity to known campaigns or
    actors where the evidence supports it.
  </Card>

  <Card title="Exposure checks" icon="envelope">
    Check whether an email address or domain appears in known breaches, and review
    domain-security posture.
  </Card>
</CardGroup>

## How to Use Orion

Ask Orion in plain language, and `@`-mention it to send an investigation straight its way:

* *"@Orion investigate the domain example-malicious.com and tell me if it's linked to known campaigns."*
* *"Is this IP address associated with malicious activity?"*
* *"Check whether this email address has been exposed in a breach."*

## In the SOC Flow

When you investigate an alert, Centurion's SOC variant can call on Orion to enrich the detection — turning raw indicators into context you can act on. This is often the first step of an investigation: understand what you're looking at before you respond.

## From Intelligence to Action

Orion tells you what's dangerous; the rest of the team acts on it. Once Orion confirms a threat, [Hydra](/documentation/multi-agent-system/integration-specialist-agent) can block it on your firewalls, [Perseus](/documentation/multi-agent-system/agent-endpoint-specialist) can respond on an affected host, and [Scribe](/documentation/multi-agent-system/scribe) can document the whole investigation.

<Note>
  Orion focuses on threat-specific intelligence. For general web research and
  external context, that's [Iris](/documentation/multi-agent-system/iris).
</Note>