Threat Intelligence
Threat Intelligence Feeds
IOC feeds matched against every event.
Available as a standalone module · Add to my package18,406Active IOCs
57Matches today
212Techniques covered
- URLhaus, ThreatFox, OTX and moreActive
- Real-time IOC matchingActive
- Enrichment on every eventActive
- Asset-matched notificationsActive
What it does
Indicators from open and commercial feeds are refreshed on a schedule and matched in real time against IPs, domains, URLs and hashes in your events.
URLhaus, ThreatFox, OTX and more
Real-time IOC matching
Enrichment on every event
Asset-matched notifications
Live demo
Runs in your browser on sample data. Click around, nothing here touches a real system.
0
attacks/hr
18,042
IOC Indicators
15+
Active Feeds
Spamhaus DROP
4,201
DShield Blocklist
3,847
OpenPhish
2,103
Feodo Tracker
1,924
URLhaus
5,967
Recent IOC Matches
How it worksin three steps.
Ingest
Open and commercial feeds refresh on a schedule.
Match
Every IP, domain, URL and hash in your events is checked.
Prioritise
Matches raise risk scores and open incidents where it matters.
Works best withthese modules.
See all 30 modules
Detection & Response
Incident Management
Correlated incidents with severity, assets and timeline.
Learn more Detection & ResponseThreat Hunting
Hypothesis-driven hunts across all your telemetry.
Learn more Endpoint SecurityVulnerability Management
Installed software matched against known CVEs.
Learn moreAlso in Threat Intelligence
Ready to see it on your own data?
A 30-minute walkthrough with an engineer, tailored to your environment.