Intelligence

What the sources say, and who said it.

Bring an address, a domain, a file hash, a CVE or a threat actor's name. Intelligence shows what each source says about it, when it said it and how it has moved; a CVE's record lists the published rules that cite it.

Create a free account Read the feed

How much Intelligence holds

indicators reported: 300,332
vulnerabilities: 382,010
threat actors: 213
campaigns: 60

From 46 sources, holding about 450K assertions and about 81.5K relationships between them. Those last figures are estimates, not counts.

What you can bring

Three kinds of record, and what each one answers.

Everything below needs a free account, except the feed. Nothing on this page names a source: which ones cover a value is part of what its record shows you.

An indicator

An address, a domain, a URL, a file hash or an email address.

Indicator recordFree account: What each source says the value is, who publishes that source, and when.
Ask on demandFree account: When a value is new to us, ask the providers that cover its kind, within a daily allowance.
Copy and exportFree account: The value as it is or defanged, and the record as STIX.

A vulnerability

A CVE, by its identifier.

CVE recordFree account: CVSS, EPSS, known exploitation, weaknesses, affected products, who wrote about it and the rules that cite it.

A threat

A threat actor, malware, a tool or a campaign, by name.

Actors and malwareFree account: Threat actors, malware, tools and campaigns, with what connects them.

Across all of them

Not tied to one kind of record.

Look up a valueFree account: Addresses, domains, URLs, file hashes, email addresses, CVEs and threat actors by name.
What changedFree account: How an indicator or a CVE moved, and when.
WatchingFree account: Follow a CVE or a feed entry and see what changed since your last visit.
Emerging threatsNo account: Each day, the vulnerabilities worth a look, with the published rules that cover them.
National CERT advisoriesFree account: What an advisory covers and what it mentions. You read the text where it was published.

Where it leads

From a threat to the rules that detect it.

One threat, followed through ATT&CK to the catalogue. Every name and number here is read as the page renders.

Threat · MalwarePublic
S0154Cobalt Strike
According to ATT&CK, 30 groups use it, in 6 campaigns.
TechniquePublic
T1218.011Rundll32
One of the 73 techniques it uses. 80 published rules cover it.
DetectionPublic
CobaltStrike Load by Rundll32
HighSigmaHQDetection Rule License 1.1

Works with

Where it leads.

Not included

What it does not do yet.

Alerts by email or chat
An API or outbound feeds
Looking up many values at once
Uploading your own indicators
Dark-web or leaked-credential monitoring

Bring the value you are looking at.

A free account opens every record. The feed is open to everybody.

Create a free account