Threat intelligence: turn one indicator into the whole picture
Every analysis feeds a searchable corpus of samples, URLs, infrastructure and behaviour. Search it, pivot through it, save a standing hunt against it, and pull the results into your own tooling.
What you can do with it
- Search by what you have. A hash, a domain, an address, a mutex, a string inside the binary, a malware family or an ATT&CK technique. Content search reaches inside samples, not just their metadata.
- Pivot through the graph. Start from one node and walk outward to the infrastructure it shares, the samples that resemble it and the URLs it contacts. Save the result as an investigation and export it.
- Standing hunts and alerts. Write a YARA or Sigma rule once and have it run against everything new. Watch a family, an indicator or a hunt and get notified in-app, by webhook, or into your chat platform.
- Feeds and integrations. STIX 2.1 and CSV feeds, a TAXII endpoint, a documented REST API with an OpenAPI specification, a Model Context Protocol server for AI assistants, and push connectors for common SIEM and SOAR platforms.
In the corpus today
- 114,579 public analysis reports
- ATT&CK techniques observed: T1566.002, T1105, T1112, T1543.003, T1071.001, T1547.001, T1057, T1056.001, T1055, T1059.001, T1555, T1003, T1518.001, T1059.004, T1486, T1571, T1003.001, T1497, T1562.001, T1053.005
Common questions
- Where does the data come from?
- From analyses run on this platform: user submissions plus public malware feeds, each analysed by the same pipeline. Counts describe this corpus, and pages reporting prevalence say so rather than implying a global sensor network.
- Can I get the data programmatically?
- Yes. The REST API covers submission, lookup, search, reports and intelligence, with an OpenAPI specification. STIX 2.1 and CSV feeds and a TAXII endpoint are available for indicator consumption.
- How current is it?
- Reports are indexed as they finalise, so a sample analysed a minute ago is searchable now. A stored report reflects the detection content in place when it ran, which is why re-analysing an old sample can produce a different verdict.