Enrichment

After a session ends, livewells checks the domains and public IP addresses of a case against commercial threat intelligence: reputation, blocklist hits and a risk score. It adds the result to the case.

Your analysts set the verdict.

What the case shows

For an IP address, the case shows a risk score from 0 to 100, how many engines list it, the names of those engines, the country, the network owner, and a flag for Tor, VPN, proxy, hosting or relay when one applies.

For a domain, the case shows a risk score, how many engines list it, the names of those engines, the date the domain was created and its age in days. It also shows any of these checks that apply: free hosting, URL shortener, dynamic DNS, typosquatting suspected, homoglyph suspected and recently registered.

A link shows the result of its domain.

A clean result is context. A research scanner can also score high, so the case shows the engine names beside the score.

While enrichment is running, the case shows "Reputation checks are running."

What is sent

livewells sends IP addresses and domains (host names) from a case's network record to a threat intelligence provider, to check their reputation. Each request carries one value and nothing else from the case.

livewells looks up public IP addresses and public domain names. Private addresses, local names and the background traffic of the browser stay out of the lookups.

Limits

livewells checks each domain and IP address once for a case. A case has a limit of checks, and an organisation has a limit of checks each month. When the limit of a case is reached, the case shows how many domains and addresses were not checked. When the monthly limit is used, the case shows "Threat intelligence budget for this month is used." The rest of the case stays the same.

A case checks the first three host names of each registered domain, so a link that leads to many generated host names of one domain costs three checks. livewells checks the link host, the final host and the first hosts of the redirect path first. livewells checks the first four addresses of each host name. An organisation also has a limit of checks each day and each hour. When one of them is reached, the case shows which one and how many domains and addresses were not checked. When the report of a case is too large to read, the case says so and livewells makes no checks for it.

Defanging

livewells defangs every IP address, domain and link in the enrichment.