This article describes how to configure a particular enrichment source. To see how to configure enrichers in general, see Configure enrichers.

This enricher has been deprecated in these versions of the extension:

Please use these enrichers instead:

	Specifications
Enricher name	Intel 471
Supported observable types	`uri` `domain` `host` `ipv4` `ipv6` `email` `actor-id` `hash-md5` `hash-sha256`
Output	Besides data on compromised IP addresses, domains, URLs, and emails, Intel 471 focuses on providing first-hand information related to threat actors and groups.
API endpoint	`https://api.intel471.com/v1/`
Description	This enricher provides information on compromised IP addresses, domains, URLs, and emails, as well as first-hand information about threat actors and groups.

Requirements

Automatic enrichment

Avoid setting up enrichment rules for the Intel 471 enricher.

Setting up enrichment rules for this enricher allows it to automatically run and rapidly consume your API request quota.

Instead, Intel 471 recommends you run the enricher manually.

Before using the enricher, configure it to add your Intel 471 credentials:

In the Edit enricher task view, fill out these fields:

Required fields are marked with an asterisk (*).

Field	Description
API key*	Set this to your Intel 471 API key.
Email*	Set this to the email address associated with your Intel 471 account.

These are the default configuration parameters for the Intel 471 enricher:

Required fields are marked with an asterisk (*).

Field	Description
Name	Leave this as “Intel 471”. Set by default.
Override TLP	Forces all entities and observables produced by this extension to inherit this TLP value.
Description*	Enter a description for this enricher.
Cache validity (sec)*	Set to `2592000` seconds (30 days) by default.
Rate limit (per sec)*	Set to `1000` seconds by default.
Monthly execution cap (runs)*	Set to `1000000` runs by default.
Source reliability*	Assign a reliability level to entities and observables produced by this extension. The values here are based on the Admiralty System.
Observable types*	Observable types to enrich. By default, this is set to the observables supported by the Intel 471 enricher: `uri` `domain` `host` `ipv4` `ipv6` `email` `actor-id` `hash-md5` `hash-sha256`
Enabled	Select to enable this enricher.
API URL*	Set to `https://api.intel471.com/v1/` by default.
API key*	Set this to your Intel 471 API key.
Email*	Set this to the email address associated with your Intel 471 account.
SSL verification	Selected by default. Select to enable SSL verification.
Path to SSL certificate file	Used when connecting to a feed source that uses a custom CA. Set this as the path to the SSL certificate to use when authenticating the feed source.