Threat intelligence
Commercial threat feeds, adversary profiling, dark web monitoring, and IOC enrichment platforms helping SOC teams anticipate attacker tactics and infrastructure.
Key Technical Considerations Before Procuring
Prioritize feeds with high relevance to your sector and geography, with machine-readable STIX/TAXII integrations into your SIEM and firewalls.
Documented Solutions in this Category
Showing 11 published solutions with verified evidence
Anomali ThreatStream
Anomali ThreatStream from Anomali focuses on threat intelligence collection and enrichment. It is threat intelligence technology or service used for providing external threat context for analysis and decisions. Capabilities - Threat intelligence collection: Brings threat information into a workflow that supports analysis and security decisions. - Threat indicator enrichment: Adds context to indicators so teams can assess their relevance to an investigation. - Adversary and campaign context: Provides information about activity patterns associated with threat actors or campaigns. - Threat intelligence integrations: Connects intelligence with the supported analysis tools or security workflows. - Intelligence prioritization: Helps teams focus attention on the threat information most relevant to their requirements. Use and operational context Anomali ThreatStream is relevant to analysts investigating adversaries, indicators or emerging exposures when the requirement centers on providing external threat context for analysis and decisions. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Before adoption, review source relevance, freshness, integration methods and how intelligence changes a specific investigation or protection decision. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Anomali ThreatStream focuses on providing external threat context for analysis and decisions. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
ANY.RUN Threat Intelligence
ANY.RUN Threat Intelligence from ANY.RUN focuses on malware-related threat intelligence and indicator research. It is threat intelligence technology or service used for providing external threat context for analysis and decisions. Capabilities - Threat intelligence collection: Brings threat information into a workflow that supports analysis and security decisions. - Threat indicator enrichment: Adds context to indicators so teams can assess their relevance to an investigation. - Adversary and campaign context: Provides information about activity patterns associated with threat actors or campaigns. - Threat intelligence integrations: Connects intelligence with the supported analysis tools or security workflows. Use and operational context ANY.RUN Threat Intelligence is relevant to analysts investigating adversaries, indicators or emerging exposures when the requirement centers on providing external threat context for analysis and decisions. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Before adoption, review source relevance, freshness, integration methods and how intelligence changes a specific investigation or protection decision. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? ANY.RUN Threat Intelligence focuses on providing external threat context for analysis and decisions. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Cybersixgill Threat Intelligence
Cybersixgill Threat Intelligence from BitSight focuses on deep and dark web threat intelligence analysis. It is threat intelligence technology or service used for providing external threat context for analysis and decisions. Capabilities - Threat intelligence collection: Brings threat information into a workflow that supports analysis and security decisions. - Threat indicator enrichment: Adds context to indicators so teams can assess their relevance to an investigation. - Adversary and campaign context: Provides information about activity patterns associated with threat actors or campaigns. - Dark web monitoring: Observes the external sources described by the vendor for evidence relevant to cyber risk. - Threat intelligence integrations: Connects intelligence with the supported analysis tools or security workflows. - Intelligence prioritization: Helps teams focus attention on the threat information most relevant to their requirements. Use and operational context The Cybersixgill offering addresses threat information from the external sources described by the provider. Assess the relevance of that information to an actual organization or investigation, including how an analyst validates an observation and shares the resulting intelligence. Deployment and evaluation Before adoption, review source relevance, freshness, integration methods and how intelligence changes a specific investigation or protection decision. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Cybersixgill Threat Intelligence focuses on providing external threat context for analysis and decisions. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Cyble Hawk
Cyble Hawk from Cyble focuses on threat intelligence for government security teams. It is threat intelligence technology or service used for providing external threat context for analysis and decisions. Capabilities - Threat intelligence collection: Brings threat information into a workflow that supports analysis and security decisions. - Adversary and campaign context: Provides information about activity patterns associated with threat actors or campaigns. - Dark web monitoring: Observes the external sources described by the vendor for evidence relevant to cyber risk. - Threat intelligence integrations: Connects intelligence with the supported analysis tools or security workflows. - External exposure monitoring: Adds visibility into relevant risks beyond the organization's directly managed infrastructure. - Intelligence prioritization: Helps teams focus attention on the threat information most relevant to their requirements. Use and operational context Cyble Hawk is presented for government-oriented threat intelligence requirements. Assess the intelligence use cases and collaboration needs of the intended security team, and establish which documented sources and analysis functions are relevant to that team's responsibilities. Deployment and evaluation Before adoption, review source relevance, freshness, integration methods and how intelligence changes a specific investigation or protection decision. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Cyble Hawk focuses on providing external threat context for analysis and decisions. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Cyble Vision
Cyble Vision from Cyble focuses on threat intelligence and external exposure monitoring. It is threat intelligence technology or service used for providing external threat context for analysis and decisions. Capabilities - Threat intelligence collection: Brings threat information into a workflow that supports analysis and security decisions. - Adversary and campaign context: Provides information about activity patterns associated with threat actors or campaigns. - Dark web monitoring: Observes the external sources described by the vendor for evidence relevant to cyber risk. - Threat intelligence integrations: Connects intelligence with the supported analysis tools or security workflows. - External exposure monitoring: Adds visibility into relevant risks beyond the organization's directly managed infrastructure. - Intelligence prioritization: Helps teams focus attention on the threat information most relevant to their requirements. Use and operational context Cyble Vision addresses threat intelligence and external exposure monitoring for organizational security teams. Review the specific exposure or threat question being investigated, how evidence is presented and how a finding is transferred into an operational response workflow. Deployment and evaluation Before adoption, review source relevance, freshness, integration methods and how intelligence changes a specific investigation or protection decision. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Cyble Vision focuses on providing external threat context for analysis and decisions. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Flashpoint Ignite
Flashpoint Ignite from Flashpoint focuses on threat intelligence and external risk investigation. It is threat intelligence technology or service used for providing external threat context for analysis and decisions. Capabilities - Threat intelligence collection: Brings threat information into a workflow that supports analysis and security decisions. - Threat indicator enrichment: Adds context to indicators so teams can assess their relevance to an investigation. - Adversary and campaign context: Provides information about activity patterns associated with threat actors or campaigns. - Dark web monitoring: Observes the external sources described by the vendor for evidence relevant to cyber risk. - Threat intelligence integrations: Connects intelligence with the supported analysis tools or security workflows. - External exposure monitoring: Adds visibility into relevant risks beyond the organization's directly managed infrastructure. - Intelligence prioritization: Helps teams focus attention on the threat information most relevant to their requirements. Use and operational context Flashpoint Ignite brings external intelligence into threat investigation. Review the intelligence sources and analysis areas relevant to the team, then evaluate whether the information resolves a specific question about a threat, exposure or activity of concern. Deployment and evaluation Deployment: Cloud service / SaaS. Before adoption, review source relevance, freshness, integration methods and how intelligence changes a specific investigation or protection decision. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Flashpoint Ignite focuses on providing external threat context for analysis and decisions. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Google Threat Intelligence
Google Threat Intelligence from Google Cloud focuses on threat intelligence and adversary research. It is threat intelligence technology or service used for providing external threat context for analysis and decisions. Capabilities - Mandiant intelligence context: Includes the Mandiant threat intelligence context described in Google's combined intelligence offering. - VirusTotal analysis context: Adds the documented VirusTotal-related analysis context to the intelligence workflow. - Threat intelligence collection: Brings threat information into a workflow that supports analysis and security decisions. - Threat indicator enrichment: Adds context to indicators so teams can assess their relevance to an investigation. - Threat intelligence integrations: Connects intelligence with the supported analysis tools or security workflows. - Intelligence prioritization: Helps teams focus attention on the threat information most relevant to their requirements. Use and operational context Google Threat Intelligence is relevant to analysts investigating adversaries, indicators or emerging exposures when the requirement centers on providing external threat context for analysis and decisions. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Before adoption, review source relevance, freshness, integration methods and how intelligence changes a specific investigation or protection decision. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Google Threat Intelligence focuses on providing external threat context for analysis and decisions. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Recorded Future Intelligence Cloud
Recorded Future Intelligence Cloud from Recorded Future focuses on threat intelligence and external risk analysis. It is threat intelligence technology or service used for providing external threat context for analysis and decisions. Capabilities - Linked intelligence modules: Provides the threat intelligence areas included in the selected Recorded Future offering. - External threat context: Adds documented external information to the assessment of potential cyber threats. - Threat intelligence collection: Brings threat information into a workflow that supports analysis and security decisions. Use and operational context Recorded Future Intelligence Cloud is relevant to analysts investigating adversaries, indicators or emerging exposures when the requirement centers on providing external threat context for analysis and decisions. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Before adoption, review source relevance, freshness, integration methods and how intelligence changes a specific investigation or protection decision. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Recorded Future Intelligence Cloud focuses on providing external threat context for analysis and decisions. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Sekoia Intelligence
Sekoia Intelligence from Sekoia.io focuses on threat intelligence and adversary analysis. It is threat intelligence technology or service used for providing external threat context for analysis and decisions. Capabilities - Threat intelligence collection: Brings threat information into a workflow that supports analysis and security decisions. - Threat intelligence integrations: Connects intelligence with the supported analysis tools or security workflows. Use and operational context Sekoia Intelligence is relevant to analysts investigating adversaries, indicators or emerging exposures when the requirement centers on providing external threat context for analysis and decisions. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Before adoption, review source relevance, freshness, integration methods and how intelligence changes a specific investigation or protection decision. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Sekoia Intelligence focuses on providing external threat context for analysis and decisions. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
SOCRadar Extended Threat Intelligence
SOCRadar Extended Threat Intelligence from SOCRadar focuses on external threat intelligence and digital risk monitoring. It is threat intelligence technology or service used for providing external threat context for analysis and decisions. Capabilities - Threat intelligence collection: Brings threat information into a workflow that supports analysis and security decisions. - Threat indicator enrichment: Adds context to indicators so teams can assess their relevance to an investigation. - Adversary and campaign context: Provides information about activity patterns associated with threat actors or campaigns. - Dark web monitoring: Observes the external sources described by the vendor for evidence relevant to cyber risk. - Threat intelligence integrations: Connects intelligence with the supported analysis tools or security workflows. - External exposure monitoring: Adds visibility into relevant risks beyond the organization's directly managed infrastructure. Use and operational context SOCRadar's intelligence entry addresses external threats and exposure relevant to an organization. Review a concrete asset or threat question, the evidence supplied by the platform and the workflow used to validate and assign a finding for action. Deployment and evaluation Before adoption, review source relevance, freshness, integration methods and how intelligence changes a specific investigation or protection decision. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? SOCRadar Extended Threat Intelligence focuses on providing external threat context for analysis and decisions. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
ThreatConnect Threat Intelligence Platform
ThreatConnect Threat Intelligence Platform from ThreatConnect focuses on threat intelligence aggregation and analysis. It is threat intelligence technology or service used for providing external threat context for analysis and decisions. Capabilities - Threat intelligence collection: Brings threat information into a workflow that supports analysis and security decisions. - External exposure monitoring: Adds visibility into relevant risks beyond the organization's directly managed infrastructure. - Intelligence prioritization: Helps teams focus attention on the threat information most relevant to their requirements. Use and operational context ThreatConnect Threat Intelligence Platform is relevant to analysts investigating adversaries, indicators or emerging exposures when the requirement centers on providing external threat context for analysis and decisions. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Before adoption, review source relevance, freshness, integration methods and how intelligence changes a specific investigation or protection decision. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? ThreatConnect Threat Intelligence Platform focuses on providing external threat context for analysis and decisions. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.