Indicator enrichment and research pivoting are steps in the threat intelligence process that involve gathering additional information and context about the indicators of compromise (IoCs) that are related to an incident, and using them to identify other potential sources of threat data or evidence. For example, an analyst can enrich an IoC such as an IP address by looking up its geolocation, reputation, or associated domains, and then pivot to other sources of threat intelligence that may have more information about the IP address or its activities.