URLScan module.
URLScan enriches your organization's URL and domain IOCs by searching recent scans for indicators of malicious activity. It is a bring-your-own-key integration: you create an account with urlscan.io, generate an API key, and paste it into the module once for the whole billing account. From then on, every new URL or domain indicator that arrives in your account is checked against urlscan.io, and what comes back is recorded on the indicator as a verdict, a score, and a short summary line you can read without leaving the IOC list.
You need a urlscan.io account and an API key generated from it. The key is the only thing this module asks for.
How to connect URLScan
- Sign in to urlscan.io, or create an account if you do not have one, and generate an API key.
- In Liberty91, go to Modules, open the Analysis Modules section, and click the URLScan tile.
- Paste the key into the API key field.
- Turn on Active and click update.
Checking the connection
There is no separate Test button, because saving is the health check. When you save, Liberty91 calls urlscan.io with the key you pasted and reports what came back. A green Connected banner means the credential works, and a red banner means it does not. If you leave the page and return later, a blue Status banner shows the result of the last save rather than re-testing.
| Message | What it means |
|---|---|
API key validated | The key works and the module is ready to enrich |
Invalid API key | urlscan.io rejected the key. Generate a new one and paste it again |
URLScan rate limit reached, try again later | Your urlscan.io plan is out of requests for the moment. Nothing is wrong with the key |
Could not reach URLScan | Liberty91 got no response at all, usually a transient network problem |
URLScan returned HTTP <code> | urlscan.io answered with something unexpected, and the code says what |
Leave the API key field blank when you save and the stored key is kept. That is how you turn Active off and on again without retyping it. Keys are encrypted at rest and never sent back to the browser, so the field looks empty even when a key is stored.
The module also shows IOCs enriched as a running total, which is the quickest way to confirm that indicators really are being processed.
What you get from URLScan enrichment
Every URL and domain indicator that arrives after the key is saved is looked up, and the result is written onto the indicator as one of the four verdicts used across the platform, together with a score from 0 to 100.
| What urlscan.io reports | Verdict |
|---|---|
| The scan is flagged as malicious | Malicious |
| Not flagged as malicious, but the overall score is above zero | Suspicious |
| Not flagged as malicious and the score is zero | Benign |
| No verdict data on the indicator | Unknown |
urlscan.io only has something to say about URLs and domains that have been scanned, so
expect Unknown on indicators it has not seen. When urlscan.io does return a verdict, the
summary line reads urlscan: score N | country XX | categories: ..., and that line is what
appears in the tooltip on the indicator.
In the platform you see a URLScan chip on the indicator's row and in its panel, with the
summary line in the tooltip. In an IOC CSV export, URLSCAN appears in the
enrichment_providers column, and over the API the same value comes back in the
enrichment_providers and enrichments fields on the
IOC endpoints, where you can also filter for it with
?enrichment_provider=URLSCAN.
Each vendor verdict feeds the indicator's confidence rather than replacing the verdicts already there. Two rules govern how the readings combine, and both are explained on IOC enrichment and decay scoring: verdicts only escalate, and a quiet reading is not a clean bill of health.
Permissions and limits
Any member of the billing account can configure this module. There is no Owner or Admin gate on it, unlike the ransomware domain alerts, which are restricted.
- One key per billing account, shared by everyone on it.
- Saving is rate-limited to 12 attempts a minute per user, so repeated retries pause briefly.
- Enrichment runs in batches of up to 100 indicators.
Frequently asked questions
Which indicators does URLScan enrich?
URL and domain indicators. Indicators of any other type are left alone: URLScan adds no chip and no verdict to them.
How do I know my API key worked?
Saving the key is the check. Liberty91 validates it against urlscan.io as it saves, then shows a green Connected banner on success or a red banner naming the reason it failed.
Do I have to retype the key to turn the module off and on?
No. Leave the API key field blank when you save and the stored key is kept, so you can flip Active off or on without it.