Rapid Threat Triage
Query: "Is 203.0.113.42 associated with any known threats?"
Use: Quickly validate suspicious IPs during incident investigation
Result: Reputation scores, associated campaigns, recommended actions
IOC Investigation
Query: "What malware families are associated with the hash
d41d8cd98f00b204e9800998ecf8427e?"
Use: Identify malware from file hashes found during forensics
Result: Malware classification, TTPs, detection rules
Incident Response
Query: "What is the incident response procedure for a phishing attack?"
Use: Get step-by-step IR guidance during active incidents
Result: Containment steps, evidence collection, remediation