Is Cortex is the right tool for my case?

Hello everyone,

my current setup is the following:

I have multiple lists containing iocs (url, ip and domain).
The list are in csv format, but do not have all the same header. Some are for example a single value only and some have multiple columns.

My goal is now to take all these lists and enrich them. Like a virus total lookup to get the community score or similar.

From this
ip, source
firstip, source
secondip, source

to this
ip, source, community_score, status
firstip, source, 0, 0(no information -> 0 times checked)
secondip, source, -1, 3(checked already 3 times)

Is cortex the right tool for me, and can I enrich the files directly? Or do I have to download the results and combine the two files?
Alternatively I can work with the data in a database.

I am looking forward to your answers.

Best regards
Maurice

Work Environment

No file, test, or code entry point is named. Begin with Cortex's documented analyzer and observable-ingestion workflow, then verify whether CSV or database inputs can be enriched in place; done means identifying a supported workflow or the required export and merge step.