The Cisco Umbrella Investigate Operation for ThreatQuotient enables a user to enrich indicators in ThreatQ with context from Cisco Umbrella.

The operation provides the following actions:

• Enrich - enriches a domain with contextual or historical metadata.
• Get Samples - retrieves Cisco Threat Grid samples that are related to a given domain, IP, or URL.
• Reverse WHOIS - retrieves domains related to a given email address.
• Get Associated Names - retrieves domains related to a given IP Address.

The operation is compatible with the following indicator types:

• Email Address
• FQDN
• IP Address
• URL