Software · Cybersecurity
Threat intelligence
Threat feeds filtered down to what matters for your systems, then turned into detections and blocks.
Raw threat feeds deliver thousands of indicators a day, and most have nothing to do with you. We build threat intelligence platforms that gather open, commercial and sector feeds, de-duplicate and age indicators, match advisories against the software you actually run, and push vetted items to your SIEM, firewalls and DNS filters. Analysts get a short daily list instead of a flood.
What we build
- Feed ingestion from STIX/TAXII sources, MISP communities, CISA advisories and CERT-In alerts
- Indicator scoring with confidence, source reliability and automatic expiry
- Matching of vendor advisories against your asset and software inventory
- Export of vetted indicators to SIEM watchlists, firewall blocklists and DNS filters
- Analyst workspaces for notes, ATT&CK tagging and sharing with trusted peers
- Retro-hunting that checks new indicators against weeks of stored logs
DemoInteractive · sample data
Try it live.
A working sample with made-up data. It runs in your browser; nothing is sent anywhere.
- NewCISA advisory: VPN appliance flawLookalike domain cluster (14)
- EnrichingCERT-In alert: web server patchISAC report: invoice fraud wave
- ActionedVPN appliance: 2 units patchedDNS block pushed: 14 domains
- ClosedRetro-hunt: 0 hits in 30 daysExpired: 220 IPs older than 90d
What it does well
Relevance filtering
Advisories are matched to the vendors and versions that appear in your inventory.
Indicator ageing
IP addresses and domains expire automatically, so blocklists do not go stale.
Retro-hunt on logs
New indicators are checked against stored logs, not only against future traffic.
Standard formats
STIX 2.1 and TAXII 2.1 keep sharing with partners and sector ISACs simple.
ATT&CK context
Reports are tagged by technique, linking intelligence to your detection coverage.
Controlled sharing
Traffic Light Protocol markings decide what may be shared outside your team.
Questions
Are free feeds good enough?
Open sources such as CISA advisories, CERT-In alerts, abuse.ch and sector ISACs cover a great deal. Commercial feeds can add earlier warning and analyst context in some sectors. We start with free and sector sources, measure what they catch for you, and suggest paid feeds only where a gap is clear.
How do indicators turn into protection?
Vetted indicators with good confidence are pushed automatically to SIEM watchlists, DNS filters and firewall blocklists, each with an expiry date. Lower-confidence items go to an analyst first. Every push is logged, so a wrongly blocked address can be traced and removed quickly.
Do you gather intelligence by accessing other systems?
No. We collect only from published feeds, licensed sources, trusted sharing groups and your own logs. Nothing we build probes, scans or logs in to third-party systems. The work is about recognising threats aimed at you and defending against them.