Risk tiers
Every indicator is scored 0–100: critical (80+), high (60–79), medium (40–59), low (below 40). Lists are cut on these thresholds.
FEED IP and IoC streams, shareable lists, hunting rules
Threat Feed
Scored IP, domain, URL and hash indicators are listed with context; filtered lists flow to your firewall and SIEM, and hunting rules land in your SOC tools in eight formats.
Screenshots are taken from a demo tenant; organisation names and data are entirely fictional.
An indicator list does not get more valuable as it grows. A context-free IP creates work for an analyst; a stale IoC blocks legitimate traffic. The Threat Feed adds a risk score, geolocation, ASN and source to every indicator, and you cut the list by score range and export only what you need.
What it does
TXT and JSON export
Lists are defined with an export limit and column header and plug straight into a firewall's external block list.
Eight rule formats
YARA, Sigma, Splunk, QRadar, SentinelOne, KQL, Suricata and EQL — filtered by MITRE technique and downloaded in bulk.
How it works
-
01
Collect and enrich
Indicators arrive from multiple sources; geolocation, ASN, source count and a risk score are added.
-
02
Cut and list
Filtered, shareable lists are built by score range, type and source.
-
03
Distribute
Lists are pulled with an API key; rules are loaded into SIEM and EDR, and matches come back as cases.
Sub-modules
IP-FEED
IP Feed
Attacker IPs stream with risk tier, source count, country and ASN. A live grid globe, a daily unique-IP curve and …
With risk score, geolocat…
IOC
IoC Feed
Domain, URL and hash indicators are split by type, each with total, critical and enriched counts, 14-day activity, a severity …
Domain, URL and hash indi…
LISTS
IoC Lists
Build lists filtered by score range, type and source; export as TXT or JSON and connect them to your firewall's …
Filtered, shareable block…
HUNT
Hunting Rules
A detection rule corpus in eight formats, filtered by name, author, content, rule type, severity, MITRE technique and date range, …
YARA, Sigma, Splunk, QRad…
What you get
- The firewall blocks only high-confidence indicators.
- Detection engineers get rules ready in their own query language.
- Per-indicator context shortens an analyst's decision.
Next step
What shows up on your own surface?
In a 30-minute session we run a live scan against your own domains.