Threat Intelligence
Contact Us
Browse cybersecurity research, threat data, attack techniques, statistics, and compliance guides on CyberSanso. Free to use, updated regularly.
Threat Intelligence Database: IOCs, Adversary Profiles, and Active Feed Data
Most threat intelligence resources scatter data across dozens of vendor dashboards or lock critical indicators behind enterprise paywalls. CyberSanso’s Threat Intelligence Database aggregates curated IOC feeds, adversary behavior patterns, annotated intelligence reports, and infrastructure data into one freely browsable research hub built for active defensive work.
This database supports three types of practitioners: security analysts who need to quickly validate whether an IP address, domain, or file hash appears in active threat campaigns; threat researchers building context around adversary infrastructure and tooling; and defenders mapping incoming indicators to known threat actor groups, associated TTPs, and the MITRE ATT&CK techniques they map to.
Data feeding this hub includes CISA’s Known Exploited Vulnerabilities (KEV) catalog, MISP Project public feeds, AlienVault OTX community contributions, IBM X-Force Exchange open data, and Shodan infrastructure intelligence. Every IOC entry carries a type tag, confidence level, threat actor attribution (where known), first-seen and last-seen timestamps, and associated ATT&CK technique identifiers where applicable.
What Are Indicators of Compromise (IOCs)?
An indicator of compromise (IOC) is an observable artifact that suggests a system has been compromised or is being actively targeted. IOCs are the raw material of threat intelligence: specific, measurable, and immediately actionable in a way that strategic threat reports are not.
The four primary IOC types are: IP addresses linked to attacker-controlled infrastructure, command-and-control (C2) servers, or active scanning operations; domain names registered or hijacked for phishing, malware delivery, or C2 communications; file hashes (MD5, SHA-1, SHA-256) uniquely identifying specific malware samples; and URLs pointing to phishing pages, exploit kits, or payload download endpoints.
Secondary IOC types include attacker email addresses, registry key modifications, mutex names, and behavioral indicators (TTPs). Behavioral indicators are less specific than file hashes but far more durable: adversaries rotate infrastructure within days, but rarely change their core techniques for months or years. This is why MITRE ATT&CK TTP mapping adds more long-term defensive value than IP blocklisting alone.
IOC quality degrades over time. The CISA KEV catalog provides the highest-confidence IOC set available publicly: vulnerabilities confirmed to have been exploited in the wild and requiring immediate remediation under Binding Operational Directive 22-01. As of June 2026, the KEV catalog lists over 1,200 entries spanning hundreds of vendors.
- IP, domain, URL, and file hash lookup with confidence ratings
- MITRE ATT&CK TTP cross-references for each threat actor
- CISA KEV catalog integration with patch-priority metadata
- First-seen and last-seen timestamps with attribution context
Threat Intelligence Types: From Raw Feeds to Strategic Context
Not all threat intelligence serves the same purpose. The four intelligence types differ in audience, timeliness requirements, and operational value:
Technical intelligence (IOCs, file hashes, IPs) is consumed directly by security tools: SIEM blocklists, EDR exclusion rules, and firewall deny lists. It has a short half-life – often measured in hours for IP addresses and days for domains – and must be automated to be useful at volume.
Tactical intelligence (TTPs, adversary procedures) describes how threat actors operate: their preferred initial access methods, lateral movement techniques, and persistence mechanisms. It feeds threat modeling, purple team exercises, and detection rule creation. Tactical intelligence is slower to change and more valuable per unit of analyst effort.
Operational intelligence covers active campaigns: which threat groups are targeting which sectors, what lures they are using in current phishing campaigns, and what infrastructure changes signal an imminent operation. It requires ongoing monitoring of dark web forums, paste sites, and threat actor communication channels.
Strategic intelligence informs executive-level risk decisions: geopolitical threat contexts, nation-state targeting priorities, and long-term trend data. Sources include government advisories (CISA, NSA, Five Eyes joint advisories), threat research reports from Mandiant, CrowdStrike, and Microsoft, and sector-specific information sharing organizations (ISACs).
Free Threat Intelligence Resources for Defenders
Quality threat intelligence does not require an enterprise budget. The following freely available resources provide significant defensive value:
CISA Known Exploited Vulnerabilities (KEV) Catalog: The highest-confidence public list of vulnerabilities confirmed exploited in the wild. Updated continuously. Every organization should monitor and remediate KEV entries as a baseline priority, ahead of CVSS-score-only patch queues.
MISP Project public feeds: Community-maintained IOC feeds covering malware families, phishing campaigns, and infrastructure indicators. Requires MISP instance or compatible TIP for automated ingestion.
AlienVault OTX (Open Threat Exchange): Over 200,000 community-contributed threat pulses covering IP addresses, domains, URLs, file hashes, and malware signatures. Available via API at no cost.
VirusTotal public API: File hash, URL, and domain reputation lookups against 70+ antivirus engines. Free tier allows 500 API requests per day – sufficient for manual triage and enrichment workflows.
Shodan: Infrastructure search engine that indexes internet-connected devices and services. Useful for identifying attacker-controlled infrastructure and exposed assets in your own network. Free tier covers basic searches; monitoring requires a paid plan.
IBM X-Force Exchange: Threat intelligence platform offering free access to indicator lookups, threat reports, and collections. Strong coverage of banking trojans, commodity malware, and enterprise-targeted campaigns.
How to Integrate IOC Feeds into Your Security Stack
Raw IOC feeds provide little value without an integration path into your defensive tools. The standard integration architecture connects threat feeds to four control points:
SIEM integration: Import IOC feeds as watchlists or lookup tables in your SIEM (Splunk, Microsoft Sentinel, Elastic). Incoming logs are cross-referenced against active indicators in real time, generating alerts when network traffic or process activity matches a known-bad indicator. Most SIEMs support STIX/TAXII 2.1 for automated feed ingestion.
EDR enrichment: File hashes and process indicators from threat feeds can be pushed to your EDR platform to enable retroactive hunting: search historical telemetry for past occurrences of newly identified indicators before they were known threats. CrowdStrike Falcon, SentinelOne, and Microsoft Defender all support IOC import via API.
DNS and firewall blocking: Domain and IP blocklists can be applied at the DNS resolver layer (using Quad9, Cisco Umbrella, or Cloudflare Gateway) and at the perimeter firewall. DNS blocking is more operationally manageable at scale than IP blocking because domains are the more stable unit of adversary infrastructure.
Email security: URL and domain IOCs can be fed to email gateways and phishing detection platforms to block known-malicious sender domains and URLs in real time. Integration with platforms like Proofpoint, Mimecast, or Microsoft Defender for Office 365 is typically available via TIP connector or direct API.
Suspendisse ut ultricies augue. Sed at leo vitae tempus. Quisque a vel nulla vestibulum eleifend at id augue. Nullam volutpat justo eget justo finibus mattis. Nam, massa sit amet euismod fermentum.
Suspendisse ut ultricies augue. Sed at leo vitae tempus. Quisque a vel nulla vestibulum eleifend at id augue. Nullam volutpat justo eget justo finibus mattis. Nam, massa sit amet euismod fermentum.
Suspendisse ut ultricies augue. Sed at leo vitae tempus. Quisque a vel nulla vestibulum eleifend at id augue. Nullam volutpat justo eget justo finibus mattis. Nam, massa sit amet euismod fermentum.
Suspendisse ut ultricies augue. Sed at leo vitae tempus. Quisque a vel nulla vestibulum eleifend at id augue. Nullam volutpat justo eget justo finibus mattis. Nam, massa sit amet euismod fermentum.
Suspendisse ut ultricies augue. Sed at leo vitae tempus. Quisque a vel nulla vestibulum eleifend at id augue. Nullam volutpat justo eget justo finibus mattis. Nam, massa sit amet euismod fermentum.
Suspendisse ut ultricies augue. Sed at leo vitae tempus. Quisque a vel nulla vestibulum eleifend at id augue. Nullam volutpat justo eget justo finibus mattis. Nam, massa sit amet euismod fermentum.