Bulk lookups can help investigators triage many IP addresses or file hashes, but they do not replace evidence collection or prove that an indicator was involved in an incident. Keep provider context separate from observed facts, and preserve the evidence needed to reproduce each conclusion.

Preserve before enriching

Follow the organization's evidence-handling process before making changes to affected systems. Record collection time, source, system identity, acquisition method, and integrity checks where required. Preserve the original log or artifact and work from a documented copy. Enrichment should add context to the evidence, not replace or modify it.

Build an event-linked indicator list

Extract candidate IP addresses and hashes with their source event, timestamp, host, account, process or connection context, and collection location. Deduplicate exact values for efficient enrichment, but keep a mapping back to every event where each value appeared. An indicator detached from its event is difficult to interpret during timeline analysis.

Use reputation as a lead, not as evidence of execution

Record the provider, lookup time, report window, and response status. A hash match can connect a file to provider reporting about the same bytes; it does not show that the file executed on a particular host. An IP report does not show that a specific connection was malicious. Missing data, a timeout, or no detections should remain an unknown result unless other evidence resolves it.

Before submitting internal indicators to an external service, check the organization's policy and the provider's data-handling terms. Some indicators or associated metadata may reveal sensitive incident information.

Return results to the timeline

Join results to the original event identifiers and keep event time distinct from provider query time and provider first- or last-seen time. This prevents a later lookup from being mistaken for evidence that an indicator was known or active at the time of the event.

For an IP address, compare direction, port, DNS context, source asset, and related process or authentication events. For a file hash, correlate file path, signer, process ancestry, execution status, and subsequent network activity. A timeline should show the observed sequence and any gaps, not just a list of enriched indicators.

Expand scope with testable hypotheses

Use a related indicator as a lead to search additional retained telemetry. State the hypothesis and time range, such as whether another host contacted the same destination after the same process ran. A shared ASN, hosting provider, or vendor label alone is not sufficient to link events or attribute an operator.

Document uncertainty and limitations

• Separate observed facts, provider assessments, and analyst inference.
• Record missing logs, retention gaps, and failed lookups.
• Note alternative explanations and what evidence could distinguish them.
• Keep the query parameters and source references needed for another reviewer to reproduce the work.

Prepare before an incident

Forensic readiness depends on knowing which systems generate useful logs, how long they are retained, who can collect them, and how collection is authorized. Test that process before an incident. Bulk analysis can make a prepared evidence set easier to review, but it cannot recover telemetry that was never collected or retained.