Cutting Through the Noise: RIOT Enrichment Drives SOC Clarity

This article describes how Expel integrates the Greynoise RIOT API into its detection and orchestration workflow (Ruxie and Josie) to enrich IP and domain telemetry. The enrichment provides context—such as trust levels, CDN classification, and domain registration dates—that helps analysts quickly rule out benign business traffic and reduce false positives, allowing the SOC to focus on higher-priority security signals.