One thing that legal entities for large organizations are looking for is attestation. I worked for a SOAR company and we implemented a few play books for compan

One thing that legal entities for large organizations are looking for is attestation. I worked for a SOAR company and we implemented a few play books for companies that both pulled data from URLscan as well as enriched it with other data and then presented to the legal department in a packaged format right to their inbox/Slack/other so they didn't have to go somewhere and download it. I'm not sure it's the feature set you're looking for but I feel as though attestation data is generic enough that it's useful in the SOC as well. The use case for this was take down requests of lookalike / copycat domains. Some of these, we found, were being used (or attempted to be used) in more advanced phishing campaigns.