Criminal IP and Palo Alto Networks Cortex XSOAR integrate to bring AI-driven exposure intelligence to automated incident response

According to CyberNewsWire, Criminal IP, the AI-powered threat intelligence platform developed by AI SPERA, is now officially integrated into Palo Alto Networks’ Cortex XSOAR, embedding real-time external threat context, exposure intelligence, and automated multi-stage scanning directly into the orchestration engine.

The integration, available via the Cortex Marketplace, lets Cortex XSOAR evaluate suspicious IPs and domains using not only static reputation data but also behavioural signals, exposure history, infrastructure correlations and AI-driven threat scoring. The three-stage scanning workflow begins with a Quick Lookup, escalates to a Lite Scan, and culminates in a Full Scan, with results delivered as structured reports within Cortex XSOAR and generic polling to keep the workflow moving automatically.

In addition to alert-driven enrichment, the integration links internal telemetry with open-internet intelligence, offering historical behaviour, C2 relationships, anonymisation indicators, abuse records and SSL correlations for each indicator, plus the ability to schedule Micro Attack Surface Management scans for lightweight, continuous ASM. AI SPERA chief Byungtak Kang described the move as underscoring the growing importance of AI-driven threat intelligence in enterprise security operations.