Threat Intelligence Services Permissions
CloudPeek's enrichment tools (see Tools & Integrations) call external threat intelligence services with a simple API key each. They are all read-only lookups: CloudPeek sends an indicator (an IP, domain, hash, URL or CVE) and gets intelligence back. None of them touch your tenant data.
| Service | Credential | Use case |
|---|---|---|
| VirusTotal | API key | Look up IPs, domains, file hashes and URLs across 70+ engines to establish whether an indicator from an alert is known-bad (virustotal_ip_lookup, virustotal_domain_lookup, virustotal_file_lookup, virustotal_url_lookup) |
| Shodan | API key | Check what an IP exposes to the internet and resolve DNS, useful for assessing attacker infrastructure or your own exposed assets (shodan_host_lookup, shodan_host_search, shodan_dns_resolve, shodan_dns_reverse) |
| GreyNoise | API key | Separate targeted attacks from internet background noise: is this IP scanning everyone, or just you? (greynoise_community_lookup, greynoise_ip_context, greynoise_riot_lookup) |
| AbuseIPDB | API key | Check an IP or network block against community abuse reports and pull the blacklist (abuseipdb_check_ip, abuseipdb_check_block, abuseipdb_get_blacklist) |
| NVD | API key (optional) | Search CVEs and CPEs when tying an alert to a known vulnerability; works without a key, and a free key raises the rate limit (nvd_search_cves, nvd_search_cpes) |
| Cloudflare | API token plus account ID | Look up domain and IP intelligence, and submit a URL for sandboxed scanning when investigating a suspicious link (cloudflare_lookup_domain, cloudflare_lookup_ip, cloudflare_scan_url, cloudflare_get_scan_status) |
Cloudflare token scopes
The Cloudflare API token is the only one with named scopes. Create it with just:
| Scope | Why |
|---|---|
| Intel: Read | Domain and IP intelligence lookups |
| URL Scanner: Write | Submitting a URL scan creates a scan job, so the scanner scope needs Write as well as Read to fetch results |
Note
A privacy consideration applies to all of these services: the indicators CloudPeek looks up (IPs, domains, hashes, URLs) are sent to the third-party service as part of the query, and some services record submissions. If certain indicators are too sensitive to share externally, simply do not configure that service; every enrichment tool is optional and independent.