Enrich internal telemetry with authoritative internet context to validate exposure, identify related infrastructure, and understand attacker staging and hosting patterns.