Threat Intelligence
Feeds, platforms and tooling that collect, enrich and operationalize indicators and adversary tradecraft. Passive internet search stays in OSINT & Reconnaissance; SIEM and detection stay in Defensive Security & Monitoring.
Mate Security
Mate Security is an AI SOC platform whose agents triage and investigate every alert, hunt threats from CTI reports, tune detections, and take response actions.
Cloudflare Zero Wire
Cloudflare Zero Wire is a free public vulnerability intelligence feed on Cloudflare Radar with plain-language briefings on critical internet-facing CVEs.
Threat IntelligenceFree
urlscan.io
urlscan.io is a freemium web sandbox used to scan suspicious URLs and record what a page loads, contacts, and shows for threat analysts and SOC teams.
Threat IntelligenceFreemium
Sigma
Sigma is a free open signature format used to write and share platform-neutral detection rules across SIEM tools for detection engineers and threat hunters.
TheHive
TheHive is a freemium incident response platform used to manage security cases, alerts, and tasks for SOC, CSIRT, and CERT teams working together.
OpenCTI
OpenCTI is an open-source threat intelligence platform used to store and link cyber knowledge, free under its own Apache 2.0 Community Edition.
Threat IntelligenceFreemiumOpen source
MISP
MISP is a free open-source threat intelligence platform for collecting, correlating and sharing cyber threat indicators across trusted communities.
Threat IntelligenceFreeOpen source
AbuseIPDB
AbuseIPDB is a freemium IP abuse reporting and reputation service with a free API tier plus paid Basic and Premium plans for higher limits.
Threat IntelligenceFreemium
Open Threat Exchange (OTX)
Open Threat Exchange (OTX) is LevelBlue's free community TI platform for sharing pulses and IoCs (formerly AlienVault OTX).
Threat IntelligenceFree
Recorded Future
Commercial threat intelligence platform that correlates open-web, dark-web and technical signals to help teams prioritize cyber risk.
Threat IntelligencePaid
VirusTotal
Online multi-engine scanner for analyzing files, URLs, domains and IPs for malware signals, with free public and paid tiers.