Hand it an indicator, get back a case
The Lookup agent does the research an analyst would — pulls the sources, reads them, extracts the indicators, and shows its work.
Investigating an indicator usually means ten browser tabs: a reputation service, a couple of feeds, a sandbox report, a threat-actor writeup, and a lot of copy-paste. Most of that time isn't analysis. It's gathering.
The Lookup agent does the gathering for you. Give it an IP, a domain, or a hash, and it pulls from your connected sources and the open web, reads the results, extracts the indicators and the context, and assembles them into one view — with every finding cited back to where it came from.
The point isn't to replace your judgment. It's to hand you a finished case instead of a blank search box. You see the sources it used and can follow any of them; nothing is asserted without a citation you can check.
Because it draws on the same evidence the platform scores on, the research and the verdict line up. You're not reconciling an agent's freeform summary against a separate number — you're reading one case, evidence and score together.
Ask it to look into a subject rather than a single indicator and it works the same way: gather, read, cite, and leave the conclusions to you.
- Pulls from your connected sources and the open web in one pass.
- Every finding is cited — nothing asserted without a source you can check.
- Research and verdict draw on the same evidence, so they line up.