Bulk Analyze

Bulk Analyze lets you check multiple indicators simultaneously - perfect for triaging large IP or domain lists, assessing suspicious infrastructure, or analyzing indicators from alerts, logs, and threat feeds.

Prerequisites

You need:

• A Validin Pro or Enterprise account
• A list of indicators (domains, IPs, URLs) in defanged or raw format

Run a bulk search

1. In the Validin dashboard, click Bulk Analyze.
2. Add your indicators, separated by spaces. Press enter for new lines.

📘

Defanged indicators

Defanged indicators have malicious characters replaced with safe alternatives (e.g., hxxp:// instead of http://). Validin automatically parses defanged indicators from your input, including from complete threat reports.

3. Select Next to review extracted indicators.

Review results

Extracted indicators appear in a tabulated view with Indicator and Type columns.

1. Select an indicator to open a slide-out panel containing additional information, including:
   1. Reputation
   2. Usage
   3. Geolocation
2. Click any available link to pivot across other sources of information

3. Use the checkboxes to select multiple indicators, and the icons on top of the table to:
   1. Export indicators and rows as a CSV
   2. Add selected indicators to an existing or new Project