Automatically score suspicious domains and alert on real threats

flowchart TD trig>"new suspicious DNS traffic detected"]:::trig s0["Detect suspicious domain"]:::task s1["Combine threat check results"]:::task s2["AI assigns threat score"]:::task s3["Send alert for serious threats"]:::svc trig --> s0 s1 --> s2 s2 --> s3 gx{"+ which threat sources to check"}:::gate s0 --> gx p00["Query VirusTotal database"]:::task gx -->|"VirusTotal check"| p00 p10["Query abuse tracking database"]:::task gx -->|"Abuse check"| p10 jn{"+ combine findings"}:::gate p00 --> jn p10 --> jn jn --> s1 out[/"consolidated threat report and alert"/]:::out pay{{"cuts through alert noise for real threats"}}:::pay s3 --> out out --> pay classDef task fill:#e7f6fe,stroke:#34b8f0,color:#2c2a29 classDef svc fill:#f6f8fa,stroke:#7c8795,color:#2c2a29 classDef mi fill:#e7f6fe,stroke:#0079a8,color:#2c2a29,stroke-width:2px classDef human fill:#fff,stroke:#0079a8,color:#0079a8 classDef store fill:#f6f8fa,stroke:#0079a8,color:#2c2a29 classDef trig fill:#00a4eb,stroke:#0079a8,color:#fff,font-weight:bold classDef trigtime fill:#00a4eb,stroke:#0079a8,color:#fff,font-weight:bold classDef trigdata fill:#8ad4f5,stroke:#0079a8,color:#06314c,font-weight:bold classDef gate fill:#fff,stroke:#e8a23d,color:#6b4708,font-weight:bold classDef out fill:#1f9d6b,stroke:#167a53,color:#fff,font-weight:bold classDef pay fill:#06314c,stroke:#021f33,color:#fff