The threat intelligence lifecycle becomes burdensome when security teams have to manually ingest indicators, format the data, and go through several sources to enrich them. In the current security scenario, hundreds and thousands of indicators of compromise (IOCs) are collected on a daily basis, and enriching them manually is not viable for any productive and result oriented security team. With automation, threat intel ingestion, enrichment, and analysis can be performed quickly and consistently. SOAR (Security Orchestration, Automation and Response) platforms automatically ingest and normalize IOCs from multiple sources and enrich them. Data can be enriched from several enrichment databases such as VirusTotal, Hybrid Analysis Whois, and NVD among others. Subsequently, a SOAR tool can score the intel and help formulate the following course of response action for an incident.