Best Threat Intelligence Software - Page 11

Exodus Intelligence Vault

Expose

AI-powered engine that cross-references billions of public data points across the internet and delivers a complete, structured overview in moments.

Falconfeedsio

Falcon Feeds.io is a cutting-edge, cloud-native SaaS platform that specializes in cyber threat intelligence. It vigilantly monitors and delivers the latest security incidents and insights on threat actors from around the globe, around the clock. Our expansive coverage includes the surface web, Tor networks, and Telegram channels. With Falcon Feeds.io, you can: Continuous Monitoring: Keep a watchful eye on threat actors, ransomware attacks, DDoS attacks, and other security incidents around the clock. Comprehensive Analysis: Stay informed about the most affected geographies, industries, organizations, and domains in real-time. Unrestricted Access: Gain unlimited access to our extensive threat feed database to empower your security measures. Customizable Alerts: Configure alerts tailored to new threats related to specific threat actors, incident categories, countries, industries, organizations, and domains. Seamless Integration: Utilize our robust API and Webhook integration for a smooth and streamlined security workflow. Real-Time Notifications: Get instant notifications through Slack, Microsoft Teams, and email, ensuring you never miss a critical update.

Flowmon ADS

Galileo Signals

Galileo Signals helps threat-intelligence, SOC, MDR, email-security and brand-protection teams investigate reported emails, discover related phishing and scam campaigns, monitor indicators and entities, and validate security controls using current spam-trap telemetry.

HAWK - Dark Web Exposure Scanner

Hawk scans the dark web, breach corpora, and infostealer logs for your organization's exposed credentials, then delivers an executive-grade risk report in seconds. Powered by elite intelligence sources, built by Mercurius.

Horizon®

Horizon® is an open source intelligence and data analysis platform that enables organizations to collect, analyze, and operationalize publicly available online information to support investigations, security operations, and risk management. The platform is designed to help users identify relevant digital signals, monitor online activity, and derive actionable insights from large volumes of open source data. Horizon® supports a wide range of investigative and intelligence workflows by providing tools to search across surface web sources, analyze online entities, and identify connections between people, organizations, and digital infrastructure. It is used by security teams, investigators, analysts, and risk professionals who require timely access to structured and unstructured online information. Common use cases include threat intelligence, investigations, fraud detection, insider risk analysis, and situational awareness. The platform enables users to conduct targeted searches, track changes over time, and organize findings within a centralized environment. Horizon® is built to support both proactive monitoring and reactive investigations, allowing teams to respond to emerging risks and incidents more efficiently. It integrates data collection with analysis and reporting workflows, helping users move from raw information to informed decision making. Horizon® is used across multiple industries, including enterprise security, government, financial services, and compliance driven organizations. It supports collaboration among teams by enabling shared access to findings and consistent investigative processes. The platform is designed to scale with organizational needs and accommodate both routine monitoring and complex investigative requirements. Key capabilities of Horizon® include: - Open source data collection and search across online environments - Entity analysis to identify relationships and digital footprints - Monitoring and alerting to track changes and emerging activity - Investigation workflows for organizing, analyzing, and reporting findings - Support for security, intelligence, and risk management use cases By combining data collection, analysis, and operational workflows in a single platform, Horizon® helps organizations better understand online activity and manage digital risk using publicly available information.

Huntbase

Huntbase is the open threat-hunting platform for lean SOC, threat hunting and incident response teams. Most security tools only hunt in history. Huntbase searches stored history across every tool you already own, then asks what's true right now: on your hosts, in your cloud infrastructure and in the state of your SaaS applications. So you can find what was never logged. Search where the data lives. One search runs across your SIEMs, EDRs, clouds and your own data lake, with no second copy. Every result shows its source. Huntbase has 158 documented integrations, including Splunk, Microsoft Sentinel, Elastic, CrowdStrike and SentinelOne. Hunt with Scout, your investigation partner. Scout plans the hunt, writes each query in that tool's own language (KQL, SPL, ES|QL, SQL) and cites the rows behind every claim. If it can't back a claim up, it says so. Ask the host. When the log was never collected, the endpoint agent answers live. Nothing changes on a host until two people sign off: signed scripts, staged rollout, every step audited. Turn findings into tested detections. Sigma and native rules are tested against more than 1,250 recorded attacks before they can page anyone. Open by default. OCSF, Sigma, STIX and CACAO in and out. Your data stays in your stores, and your hunt playbooks and rules export. Start from proven hunts. Huntbase Hub (hub.huntbase.io) publishes 241 reviewed hunt playbooks built from public research, each crediting its researcher and naming its blind spots. Built for SOC analysts, threat hunters, incident responders, detection engineers and MSSPs, with separate scope for every client organisation. Priced on outcomes, never per user, so every analyst can hunt, whatever their skill level. Founded in London in 2024 by former Mandiant, Tanium and EclecticIQ practitioners.

iDNA

Infrawatch

Infrawatch scans the global public IPv4 and IPv6 ranges for malicious infrastructure. Identify malicious hosts before they are operationalised by an adversary. Discover, block, and explore residential proxy networks, VPNs, command-and-control (C2) servers, and more - all in real-time and attributed to a service.

InSights

Harness InQuest’s unique perspective and insight to find threats months before the competition. Our Threat Intelligence team gathers and analyzes unique data sources from open source industry feeds, as well as InQuest proprietary data sets, to provide you with leading edge and highly-trusted indicators of compromise so you can stay ahead of emerging threats and reduce dwell times.

IntelMind

isMalicious

isMalicious is a real-time threat intelligence platform that helps security teams and developers detect malicious IPs, domains, and URLs. It aggregates data from 600+ curated intelligence sources into a database of 500M+ threat records, delivering sub-100ms API responses for production-grade security decisions. Unlike file-focused scanners, isMalicious is purpose-built for IP and domain reputation checking at scale. The unified REST API covers IPs, domains, URLs, email addresses, and file hashes through a single endpoint. Features include a Streaming API for real-time threat feeds (<5s latency), webhooks for event-driven alerting, built-in monitoring with watchlists, and bulk processing for batch operations. isMalicious offers official SDKs for Python, Node.js, Go, and Rust, plus an interactive API playground for testing. It integrates with any SIEM (Splunk, QRadar, Sentinel), SOAR platform, or custom application — no vendor lock-in. Enterprise plans with STIX/TAXII and dedicated infrastructure are available.

Jizô

Jizô is a network observability platform that enables decision-makers to anticipate, identify and block cyber-attacks, thanks to unique and innovative AI. Jizô has proved to be highly effective on a number of critical networks used by major companies and public authorities. Sesame*it, the publisher of Jizô, is one of the Representative Vendors in the Gartner® Market Guide 2024 for Network Detection and Response Solutions.

Kaspersky Threat Data Feeds

Over 30 threat data feeds, tailored to diverse security needs across both IT and OT, provide information on known malware, phishing websites, the latest vulnerabilities, and exploits. Kaspersky Threat Data Feeds provide information on known malware, phishing websites, latest vulnerabilities, exploits, and more. Organizations can use this information to block malicious traffic, update their security software, and take other measures to protect themselves from cyberattacks. • Reinforces your security solutions, including SIEMs, NGFW, IPS / IDS, security proxy, etc., with continuously updated IoCs and actionable context • Improves detection quality, reduces false positives and protects the software development process thanks to actionable context • Integrates with security controls and TI platforms, including Kaspersky CyberTrace, for effective threat intelligence management and proactive cyber threat protection • Helps security teams quickly identify critical alerts from SIEM, NGFW, TI platforms, and prioritize them for incident response teams by automating the initial triage process