Partnerships

Accenture CTI Threat Feed

Technology Integration

The Accenture CTI Threat Feed is a highly refined, human-curated, intelligence source that provides insight on the latest threats with an exceptionally low false-positive ratio. Coupled with Accenture’s world-class cybersecurity services, our CTI Threat Feed will help your teams to achieve more than just “cyber security”; they will help you achieve cyber resilience.

AlienVault

Integration Partner

The AlienVault Open Threat Exchange (OTX) is a system for sharing threat intelligence among OSSIM users and AlienVault customers.

AlienVault Open Threat Exchange

Technology Integration

The AlienVault Open Threat Exchange (OTX) is a system for sharing threat intelligence among OSSIM users and AlienVault customers.

Amazon

Integration Partner

Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance. This means customers of all sizes and industries can use it to store and protect any amount of data for a range of use cases, such as websites, mobile applications, backup and restore, archive, enterprise applications, IoT devices, and big data analytics. Amazon S3 provides easy-to-use management features so you can organize your data and configure finely-tuned access controls to meet your specific business, organizational, and compliance requirements. Amazon S3 is designed for 99.999999999% (11 9's) of durability, and stores data for millions of applications for companies all around the world.

Amazon S3

Technology Integration

Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance. This means customers of all sizes and industries can use it to store and protect any amount of data for a range of use cases, such as websites, mobile applications, backup and restore, archive, enterprise applications, IoT devices, and big data analytics. Amazon S3 provides easy-to-use management features so you can organize your data and configure finely-tuned access controls to meet your specific business, organizational, and compliance requirements. Amazon S3 is designed for 99.999999999% (11 9's) of durability, and stores data for millions of applications for companies all around the world.

Applied Cyber Defense Systems

Managed Service Partner

RELENTLESS DEFENSES We adapt to protect businesses from cyberattacks with sophisticated cybersecurity solutions. Our philosophy is simple. It takes a good hacker to beat a malicious one. In order to understand and defend against attacks, we need to think like they do. Our next-gen security mechanisms are supported by Intercept, engineered by ACDS, to deliver some of the most sophisticated defenses in the world – without compromise! 77% of companies do not have an incident response plan in place, and we believe that every company should be afforded the best possible protection against cybercriminals who intend to destabilize your business or success.

ASM Technologies

Managed Service Partner

Established in 1992, ASM Technologies Limited is a publicly-listed company in India with a global presence in the USA, Singapore, UK, Canada, Mexico, and Japan. With over two decades of experience, ASM has been providing world-class consulting and product development services in the areas of Engineering Services and Product R&D with successful Offshore Development & Support Centers in India and Overseas for its global clientele.

Atkins

Commercial Partner

Atkins is one of the world’s most respected design, engineering and project management consultancies. We build long-term trusted partnerships to create a world where lives are enriched through the implementation of our ideas. On July 3, 2017, Atkins was acquired by SNC-Lavalin. Founded in 1911, SNC-Lavalin is a global, fully integrated professional services and project management company and a major player in the ownership of infrastructure. The combined entity of Atkins and SNC-Lavalin has created one of the largest global engineering and project management consultancies with approximately 50,000 employees and operating across 50 countries.

Binary Defense Artillery

Technology Integration

Artillery is a combination of a honeypot, monitoring tool, and alerting system. Eventually this will evolve into a hardening monitoring platform as well to detect insecure configurations from nix systems.

Bitdefender

Integration Partner

The Bitdefender Advanced Threat Intelligence solution helps security professionals gain visibility into the latest threats by using up-to-date, contextual intelligence on URLs, IPs, domains, certificates, files, Command and Control servers and Advanced Persistent Threats.

BitDefender

Technology Integration

The Bitdefender Advanced Threat Intelligence solution helps security professionals gain visibility into the latest threats by using up-to-date, contextual intelligence on URLs, IPs, domains, certificates, files, Command and Control servers and Advanced Persistent Threats.

BitSight

Integration Partner

AnubisNetworks Cyberfeed allows customers to obtain threat intelligence on real-time security events, with monitoring of countries, organizations and their subsidiaries.

Blu5

Commercial Partner

Blu5 takes pride in supporting digitisation teams in the challenge to reduce surface of attack, while securing core critical operations. We engineer hardware and software to address the needs of Critical Infrastructures, IoT, FinTech, BioMedical, Space & Defence. Since foundation in 2007, the Blu5 R&D team, rich of 40+ patents, has been the key enabler for generating innovative solutions.

Broadcom

Integration Partner

Leveraging the extensive Symantec Global Intelligence Network, this integration feed allows users to collect raw intelligence data making it available within EclecticIQ Platform. The feed provides a broad range of insights, covering reputation and threat intelligence data for IP, URLs, attacks, bots, cnc, malware, fraud, and phishing.

CAPEC - Common Attack Pattern Enumeration and Classification

Technology Integration

Understanding how the adversary operates is essential to effective cyber security. CAPEC™ helps by providing a comprehensive dictionary of known patterns of attack employed by adversaries to exploit known weaknesses in cyber-enabled capabilities. It can be used by analysts, developers, testers, and educators to advance community understanding and enhance defenses.

Centralpoint Nederland

Commercial Partner

Centralpoint is de grootste merkonafhankelijke IT-leverancier van de Benelux en specialist in IT-oplossingen voor organisaties, klein en groot. Wij zijn professionals voor professionals en zorgen dat je altijd en overal zorgeloos kunt werken met de beste technologie. Voor elk IT-vraagstuk hebben we een concrete oplossing. We houden het eenvoudig en creëren duidelijkheid bij complexe IT-uitdagingen. Of dat nu gaat om beveiliging, dataopslag, connectiviteit, mobiel werken, beheer of onderhoud en logistiek. Wij doen alleen waar we goed in zijn, zodat jij kan doen waar jij goed in bent. Wij krijgen energie van IT en zorgen ervoor dat het werkt zoals het hoort. Onze 550 medewerkers in Nederland en België staan altijd voor je klaar!

CIRCL - Computer Incident Response Center Luxembourg

Integration Partner

CIRCL Passive SSL is a database storing historical X.509 certificates seen per IP address. The Passive SSL historical data is indexed per IP address, which makes it searchable for incident handlers, security analysts or researchers. The Passive SSL enricher will retrieve domains and IP’s associated with an SSL Certificate hash.

CIRCL Passive SSL

Technology Integration

CIRCL Passive SSL is a database storing historical X.509 certificates seen per IP address. The Passive SSL historical data is indexed per IP address, which makes it searchable for incident handlers, security analysts or researchers. The Passive SSL enricher will retrieve domains and IP’s associated with an SSL Certificate hash.

Cisco

Integration Partner

The Cisco Umbrella API helps analysts quickly understand registration details, similar domains and potential malicious ties to observable data. With this integration, analysts can quickly discern threats and attribution intelligence from observables used in active campaigns as the cloud-based enricher provides information relating domains, IP addresses and file hashes. Combining this integration with EclecticIQ Platform enables analysts to dynamically build a repository of intelligence relating to domain activity.

Cisco OpenDNS / OpenResolve

Technology Integration

Take faster action on newly discovered malicious domains by leveraging a turn-key integration between Cisco and OpenDNS. Through security automation, dwell time is reduced from hours or days to only minutes. And by gaining Internet-wide visibility in real-time, you will discover more compromised systems.

Cisco Threat Grid

Technology Integration

Cisco Threat Grid analyzes suspicious behavior in your network against more than 450 behavioral indicators and a malware knowledge base sourced from around the world. Threat Grid content feeds are pre-generated, curated sets of behavioural indicators that are produced in the Threat Grid Cloud infrastructure from sample analysis results. Feeds are used by organizations and partners for targeted threat intelligence, by focusing on the specific types of threats faced by particular industries.

Cisco Umbrella

Technology Integration

The Cisco Umbrella API helps analysts quickly understand registration details, similar domains and potential malicious ties to observable data. With this integration, analysts can quickly discern threats and attribution intelligence from observables used in active campaigns as the cloud-based enricher provides information relating domains, IP addresses and file hashes. Combining this integration with EclecticIQ Platform enables analysts to dynamically build a repository of intelligence relating to domain activity.

Cofense

Integration Partner

Cofense PhishMe is the leading provider of human-driven phishing defense solutions worldwide. Our collective defense suite combines best-in class incident response technologies with timely attack intelligence sourced from employees. Cofense enables thousands of global organizations to stop attacks in progress faster and stay ahead of breaches.

Cofense PhishMe

Technology Integration

Cofense PhishMe is the leading provider of human-driven phishing defense solutions worldwide. Our collective defense suite combines best-in class incident response technologies with timely attack intelligence sourced from employees. Cofense enables thousands of global organizations to stop attacks in progress faster and stay ahead of breaches.

Cognyte

Integration Partner

Cognyte is a global leader in security analytics software that empowers governments and enterprises with Actionable Intelligence for a Safer World.

Common Vulnerabilities and Exposures (CVE)

Technology Integration

Enrich intelligence with exploit target information, from the standard source of vulnerabilities and exposures: the MITRE corporation. The enricher and feed uses the Computer Incident Response Center Luxembourg (CIRCL) cve-search API to retrieve all the available details.

Consortium Networks

Commercial Partner

We educate and connect the IT security community through the power of people and crowdsourced threat intelligence. Consortium Networks is committed to providing businesses with the most relevant, up-to-date technology information, with a focus on cybersecurity. By connecting technology customers, vendors, and experts, we strive to be the go-to resource for guidance regarding all your IT requirements. We are the first organization dedicated to providing real-world feedback and data on solutions in operation in production environments at peer organizations.

Cortex XSOAR (formerly Demisto)

Technology Integration

This integration harnesses the rich, aggregated threat intelligence from EclecticIQ within Demisto for automated playbook-driven incident data enrichment and response. With Demisto Enterprise, security analysts also get a centralized platform for collaboration, investigation and reporting to facilitate their investigation process and remove the need to pivot between multiple tools.

Cosive

Commercial Partner

Cosive is a specialist in incident response and threat intelligence. We have expert knowledge of CSIRTs and SOCs, and we understand your pain points. We will help you optimise your processes and tools and to find the best solution for your needs.

CrowdStrike

Integration Partner

CrowdStrike® Falcon Insight™ eliminates silent failure by providing the highest level of real-time monitoring capabilities that span across detection, response and forensics. This ensures nothing is missed, leaving attackers with no place to hide. Falcon Insight provides organizations with state-of-the-art endpoint detection and response (EDR), following an approach recommended by top analyst firms such as Gartner.

CrowdStrike Falcon Insight / EDR

Technology Integration

CrowdStrike® Falcon Insight™ eliminates silent failure by providing the highest level of real-time monitoring capabilities that span across detection, response and forensics. This ensures nothing is missed, leaving attackers with no place to hide. Falcon Insight provides organizations with state-of-the-art endpoint detection and response (EDR), following an approach recommended by top analyst firms such as Gartner.

Crowdstrike Falcon Intelligence

Technology Integration

Crowdstrike is a global leader in the cloud-delivered next-generation endpoint protection. With a single lightweight agent, CrowdStrike is the first company to unify next-generation antivirus that includes machine learning and behavioral analytics, endpoint detection and response (EDR), and a 24/7 managed hunting service all in one lightweight agent. Falcon Intelligence ^TM is a cost-effective program tailored to each company’s needs and requirements and addresses the legal and technical aspects of preventing harm that results from a cyberattack.

CyberCrime Tracker

Technology Integration

Cyber Crime Tracker is dedicated to providing an API driven IP address and domain data feed for the tracking and blacklisting of C&C server, botnet activity.

Cybereason

Integration Partner

Using the Cyberreason Defense Platform, users are able to leverage the power of EclecticIQ Platform. Users can receive IOCs from the platform to trigger security alerts, and send sightings back to EclecticIQ Platform.

Cybereason Endpoint Detection and Response (EDR)

Technology Integration

Using the Cyberreason Defense Platform, users are able to leverage the power of EclecticIQ Platform. Users can receive IOCs from the platform to trigger security alerts, and send sightings back to EclecticIQ Platform.

CyberKnight

Commercial Partner

CyberKnight Technologies is a cybersecurity focused value-added-distributor (VAD) covering the Middle East with on-the-ground presence in all key regional markets. Our ZTX (Zero Trust Security) methodology, based on the Forrester framework, incorporates emerging and market-leading cybersecurity solutions that protect the entire attack surface, by leveraging AI, threat intelligence and collective defense. CyberKnight helps security and risk teams at enterprise and government customers simplify breach detection, prevention and incident response, while addressing regulatory compliance. CyberKnight's Art of Cybersecurity Distribution methodology enables strategic partners to achieve greater market penetration, return-on-investment and time-to-value.

D3 Intelligence

Integration Partner

D3 Intelligence enables companies to connect their business, their technology, their people to their intelligence. We do this by leveraging the intelligence cycle - adopted from the government, refined for the private sector.

DeepCyber

Commercial Partner

DeepCyber supports its customers, with an “intelligence-driven” approach, to improve their proactive detection and response "capability" of cyber threats. It is specialized in Advanced Intelligence (surface, deep and dark web), Protection and Antifraud, using a methodology oriented to "data fusion".

Deloitte Risk Advisory (Italy)

Commercial Partner

Deloitte’s Cyber Intelligence Centre (CIC) has been established to be your go to resource for cyber support. We offer a broad range of cyber and managed services to help you tackle the ever changing risk landscape. Whether it’s threat monitoring, threat intelligence, data protection, incident response and more, our team of specialists can help.

Devo

Integration Partner

Devo offers cloud-native data logging and security information and event management (SIEM) solutions. Devo products for threat detection, threat hunting, threat investigation, centralized log management, monitoring stack consolidation, and AIOps.

Devoteam

Commercial Partner

Devoteam delivers Innovative Technology Consulting for Business, with a unique Transformation DNA. The 7 core offers are cybersecurity, data as a service,transformation management, agile IT, digital workplace, customer experience, and business process excellence.

Digital Shadows

Integration Partner

Digital Shadows SearchLight protects against external threats, continually identifying where your assets are exposed, providing sufficient context to understand the risk, and options for remediation.

Digital Shadows SearchLight

Technology Integration

Digital Shadows SearchLight protects against external threats, continually identifying where your assets are exposed, providing sufficient context to understand the risk, and options for remediation.

DomainTools

Integration Partner

DomainTools helps security analysts turn threat data into threat intelligence. We take indicators from your network and connect them with nearly every active domain on the Internet. Fortune 1000 companies, global government agencies, and leading security solution vendors use the DomainTools platform as a critical ingredient in their threat investigation and mitigation work.

DomainTools

Technology Integration

DomainTools helps security analysts turn threat data into threat intelligence. We take indicators from your network and connect them with nearly every active domain on the Internet. Fortune 1000 companies, global government agencies, and leading security solution vendors use the DomainTools platform as a critical ingredient in their threat investigation and mitigation work.

DomainTools Domain Profile

Technology Integration

DomainTools helps security analysts turn threat data into threat intelligence. We take indicators from your network and connect them with nearly every active domain on the Internet. Fortune 1000 companies, global government agencies, and leading security solution vendors use the DomainTools platform as a critical ingredient in their threat investigation and mitigation work.

DomainTools Reverse IP Whois

Technology Integration

The Whois Lookup API provides the ownership record for a domain name or IP address with basic registration details. The API is optimized to respond quickly and is designed to handle a high volume of parallel requests. This is the ideal product to use if you have a busy web site or a long list of domains that you need to process.

Dragos

Integration Partner

As a leading provider of industrial control systems cybersecurity, the Dragos threat detection and response platform codifies decades of real-world experience in advanced threat analytics. It provides operational and information technology practitioners unprecedented visibility and prescriptive procedures to respond to adversaries in the industrial threat landscape. Through the integration with EclecticIQ Platform, Threat Intelligence Analysts now have access to relevant reports, Indicators, Threat Actors, TTPs and observables that Dragos provides for this unique threat landscape.

Dragos

Technology Integration

As a leading provider of industrial control systems cybersecurity, the Dragos threat detection and response platform codifies decades of real-world experience in advanced threat analytics. It provides operational and information technology practitioners unprecedented visibility and prescriptive procedures to respond to adversaries in the industrial threat landscape. Through the integration with EclecticIQ Platform, Threat Intelligence Analysts now have access to relevant reports, Indicators, Threat Actors, TTPs and observables that Dragos provides for this unique threat landscape.

DShield

Technology Integration

DShield provides a platform for users of firewalls and intrusion detection systems to share intrusion information. This data is cataloged and summarized and can be used to discover trends in activity, confirm widespread attacks. This data is accessable through the Internet Storm Center/DShield REST API. DShield is a free and open service.

EclecticIQ Browser Extension

Technology Integration

The Browser Extension is an add-on for your web browser, specifically made for EclecticIQ Platform. It lets analysts quickly and easily process both external threat data found in human-written reports and machine-generated data from internal security controls. Analysts can capture the data, structure it and subsequently ingest it into their Platform in one flow, without ever leaving the page they are on.

EclecticIQ Custom Integrations

Technology Integration

Besides the integrations listed above, organizations can configure their own custom integration based on the following standards: ArcSight CEF, EclecticIQ CSV, EclecticIQ JSON, Email (IMAP), File system, FTP Push, HTTP Download, STIX 1.2, Syslog (UDP/TCP), TAXII (Poll/Push), Plain text (e.g. Snort Rules, Yara Signatures)

EclecticIQ FortiSOAR connector

Technology Integration

The EclecticIQ FortiSOAR connector, facilitates automated interactions, with the EclecticIQ platform using FortiSOAR playbooks. Add the EclecticIQ connector as a step in FortiSOAR playbooks and perform automated operations, such as retrieving reputations of domains, URLs, IP addresses, etc., from EclecticIQ, querying the EclecticIQ platform for entities, and creating sighting in the EclecticIQ platform.

EclecticIQ Security Controls

Technology Integration

Help your system administrators to respond faster to attempted intrusions by adding essential context to your IT security controls. Integrate real-time threat intelligence into:

• Snort
• Suricata
• Any standards-based IPS/IDS

EclecticIQ STIX-formatted data

Technology Integration

Any data provided in STIX (1.0, 1.1.1, 1.2) format, including FS-ISAC and MISP feeds.

Farsight Security

Integration Partner

Farsight Security DNSDB is a Passive DNS historical database that provides a unique, fact-based, multifaceted view of the configuration of the global Internet infrastructure. DNSDB leverages the richness of Farsight’s Security Information Exchange (SIE) data-sharing platform and is engineered and operated by leading DNS experts.

Farsight Security DNSDB

Technology Integration

Farsight Security DNSDB is a Passive DNS historical database that provides a unique, fact-based, multifaceted view of the configuration of the global Internet infrastructure. DNSDB leverages the richness of Farsight’s Security Information Exchange (SIE) data-sharing platform and is engineered and operated by leading DNS experts.

FireEye

Integration Partner

FireEye iSIGHT Intelligence is a proactive, forward-looking means of qualifying threats poised to disrupt your business based on the intents, tools and tactics of the attacker. Our high-fidelity, comprehensive intelligence delivers visibility beyond the typical attack lifecycle, adding context and priority to global threats before, during and after an attack. It helps mitigate risk, bolster incident response, and enhance your overall security ecosystem

FireEye iSIGHT Intelligence

Technology Integration

FireEye iSIGHT Intelligence is a proactive, forward-looking means of qualifying threats poised to disrupt your business based on the intents, tools and tactics of the attacker. Our high-fidelity, comprehensive intelligence delivers visibility beyond the typical attack lifecycle, adding context and priority to global threats before, during and after an attack. It helps mitigate risk, bolster incident response, and enhance your overall security ecosystem.

Flashpoint

Integration Partner

Flashpoint is the market leader in threat intelligence from the Deep and Dark Web. Flashpoint’s products illuminate threatening actors, relationships, behaviors, and networks.

Flashpoint

Technology Integration

Flashpoint is the market leader in threat intelligence from the Deep and Dark Web. Flashpoint’s products illuminate threatening actors, relationships, behaviors, and networks.

Forcepoint

Integration Partner

An industry leader in intelligent cybersecurity, Forcepoint enables transparent comprehensive investigation with advanced analytics like machine learning and artificial intelligence that are tuned toward specific behavior risk

FS-ISAC

Integration Partner, Community Partner

The Financial Services Information Sharing and Analysis Center is the global financial industry's go to resource for cyber and physical threat intelligence analysis and sharing. FS-ISAC operates as a member-owned non profit entity. EclecticIQ is an affiliate member.

FS-ISAC

Technology Integration

FS-ISAC leverages its intelligence platform, resiliency resources and a trusted peer-to-peer network of experts to anticipate, mitigate and respond to cyberthreats.

Global Resilience Federation (GRF)

Commercial Partner

GRF builds, develops and connects security information sharing communities. GRF is a provider and hub for cyber, supply chain, physical and geopolitical threat intelligence exchange between information sharing and analysis centers (ISACs), organizations (ISAOs) and computer emergency readiness/response teams (CERTs) from many different sectors and regions around the world.

Google

Integration Partner

Google Cloud Platform provides a suite of cloud computing services, including data management, hybrid & multi-cloud, AI and ML, built to meet your business challenges.

GreyNoise

Technology Integration

GreyNoise empowers users to differentiate between targeted cyber-attacks and pointless alerts generated by Internet-wide scan and attack activity. Think of GreyNoise as Anti-Threat Intelligence, telling you what not to worry about so you can focus on the activity that matters.

Group-IB

Integration Partner

Group-IB is a global provider of security services and threat intelligence solutions with profound expertise providing the global security community insights into Russian-speaking cyber criminal groups and their tactics.

Group-IB Threat Intelligence

Technology Integration

Group-IB is a global provider of security services and threat intelligence solutions with profound expertise providing the global security community insights into Russian-speaking cyber criminal groups and their tactics.

Hail a TAXII

Technology Integration

Hail a TAXII.com is a repository of Open Source Cyber Threat Intelligence feeds in STIX format.

Hexillion

Integration Partner

The Central Ops.net integration enables analysts to investigate domains and IP addresses. This enricher provides registrant information, DNS records and more. All the information is delivered all in one report; making it much quicker and easier for the analyst. Unlike the free service, this paid account means that there is no limit on the amount of times you need to access the tool.

Hexillion CentralOps

Technology Integration

The Central Ops.net integration enables analysts to investigate domains and IP addresses. This enricher provides registrant information, DNS records and more. All the information is delivered all in one report; making it much quicker and easier for the analyst. Unlike the free service, this paid account means that there is no limit on the amount of times you need to access the tool.

Hybrid Analysis

Technology Integration

This is a free malware analysis service for the community that detects and analyzes unknown threats using a unique Hybrid Analysis technology.

IBM QRadar SIEM

Technology Integration

IBM QRadar SIEM consolidates log events and network flow data from thousands of devices, endpoints and applications distributed throughout a network. It normalizes and correlates raw data to identify security offenses, and uses an advanced Sense Analytics engine to baseline normal behavior, detect anomalies, uncover advanced threats, and remove false positives.

IBM QRadar SOAR

Technology Integration

IBM QRadar SOAR is the leading platform for orchestrating and automating incident response processes. IBM QRadar SOAR Platform quickly and easily integrates with your organization’s existing security and IT investments. It makes security alerts instantly actionable, provides valuable intelligence and incident context, and enables adaptive response to complex cyber threats. The latest innovation to IBM QRadar SOAR, Dynamic Playbooks, provides the agility, intelligence, and sophistication needed to contend with complex attacks.

IBM Security

Integration Partner

IBM Security offers one of the most advanced and integrated portfolios of enterprise security products and services. The portfolio, supported by world- renowned IBM Security X-Force® research, enables organizations to effectively manage risk and defend against emerging threats. IBM operates one of the world’s broadest security research, development and delivery organizations, monitors 150 billion+ security events per day in more than 130 countries, and has been granted more than 10,000 security patents worldwide.

Infoblox

Integration Partner

Infoblox DDI is a industry-leading, integrated, and centrally managed approach to delivering enterprise-grade DDI. It uses the patented Infoblox Grid ^TM technology to ensure high availability DNS, DHCP, and IPAM services throughout your distributed network. Infoblox DDI makes it easier for you to achieve higher levels service uptime, security, and operational efficiencies across diverse infrastructure, including on-prem, cloud and hybrid deployments.

Infoblox DNS, DHCP, AND IPAM (DDI)

Technology Integration

Infoblox DDI is a industry-leading, integrated, and centrally managed approach to delivering enterprise-grade DDI. It uses the patented Infoblox Grid ^TM technology to ensure high availability DNS, DHCP, and IPAM services throughout your distributed network. Infoblox DDI makes it easier for you to achieve higher levels service uptime, security, and operational efficiencies across diverse infrastructure, including on-prem, cloud and hybrid deployments.

Intel 471

Integration Partner

Intel 471 provides Adversary and Malware Intelligence for leading intelligence, security and fraud teams. Adversary Intelligence is focused on infiltrating and maintaining access to closed sources where threat actors collaborate, communicate and plan cyber-attacks. Malware Intelligence leverages our underground access to provide timely data and context on malware and adversary infrastructure.

Intel 471 Adversary Intelligence

Technology Integration

Intel 471 provides Adversary and Malware Intelligence for leading intelligence, security and fraud teams. Adversary Intelligence is focused on infiltrating and maintaining access to closed sources where threat actors collaborate, communicate and plan cyber-attacks. Malware Intelligence leverages our underground access to provide timely data and context on malware and adversary infrastructure.

Intel 471 Malware Intelligence

Technology Integration

Intel 471 provides Adversary and Malware Intelligence for leading intelligence, security and fraud teams. Adversary Intelligence is focused on infiltrating and maintaining access to closed sources where threat actors collaborate, communicate and plan cyber-attacks. Malware Intelligence leverages our underground access to provide timely data and context on malware and adversary infrastructure.

IntSights Alerts

Technology Integration

The IntSights vision is to make external intelligence instantly accessible for organizations of any type or size by synthesizing complex signals captured from across the clear, deep, and dark web into contextualized, prioritized, and actionable intelligence.

Joe Sandbox

Technology Integration

Deep Malware Analysis for Windows, macOS, Linux, Android and iOS

Joe Security

Integration Partner

Deep Malware Analysis for Windows, macOS, Linux, Android and iOS

Kaspersky

Integration Partner

All the knowledge acquired by Kaspersky about cyberthreats, legitimate objects and their various relationships, brought together into a single, powerful web service. Real-time search of many petabytes of threat relationship data enables highly effective incident investigations and threat hunting.

Kaspersky APT Intelligence Reporting

Technology Integration

Exclusive, proactive access to Kaspersky’s most recent investigations and insights, revealing the methods, tactics and tools used by APT actors in high-profile cyberespionage campaigns with cross-sector targeting. Information provided in these reports allows to improve threat hunting missions and develop effective security use cases for proactive defense.

Kaspersky Threat Data Feeds

Technology Integration

Context-rich and immediately actionable threat intelligence feeds containing information on suspicious and dangerous IPs, URLs and file hashes, enable efficient alert triage process while providing enough context to immediately identify alerts that need to be investigated or escalated to incident response team.

Kaspersky Threat Lookup

Technology Integration

All the knowledge acquired by Kaspersky about cyberthreats, legitimate objects and their various relationships, brought together into a single, powerful web service. Real-time search of many petabytes of threat relationship data enables highly effective incident investigations and threat hunting.

KPN

Commercial Partner

KPN offers a suitable solution for the greatest risks in the field of cyber security. KPN makes a distinction between preventive measures, detection measures, response measures and remedial measures.

MaxMind GeoIP

Technology Integration

MaxMind an industry-leading provider of IP intelligence. EclecticIQ Platform users can leverage GeoIP databases to enrich and develop context on their IP feeds.

Micro Focus

Integration Partner

Micro Focus ArcSight ESM identifies and prioritize threats in real time so you can respond and remediate quickly. Correlate security logs from multiple data feeds, improve the accuracy of security alerts with complex use cases, and uncover advanced cyber attacks that previously went undetected.

Micro Focus ArcSight ESM

Technology Integration

Micro Focus ArcSight ESM identifies and prioritize threats in real time so you can respond and remediate quickly. Correlate security logs from multiple data feeds, improve the accuracy of security alerts with complex use cases, and uncover advanced cyber attacks that previously went undetected.

Microsoft

Integration Partner

See and stop threats before they cause harm, with SIEM reinvented for a modern world. Azure Sentinel is your birds-eye view across the enterprise. Put the cloud and large-scale intelligence from decades of Microsoft security experience to work. Make your threat detection and response smarter and faster with artificial intelligence (AI). Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs.

Microsoft Azure Sentinel

Technology Integration

See and stop threats before they cause harm, with SIEM reinvented for a modern world. Azure Sentinel is your birds-eye view across the enterprise. Put the cloud and large-scale intelligence from decades of Microsoft security experience to work. Make your threat detection and response smarter and faster with artificial intelligence (AI). Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs.

MISP

Technology Integration

MISP is an open source platform that allows for easy IOC sharing among distinct organizations. With this MISP integration, threat analysts can ingest the IOCs they receive from MISP and apply their threat investigation and dissemination workflows right from EclecticIQ Platform. Download the Solutions Brief for more detailed information.

MITRE

Integration Partner

Understanding how the adversary operates is essential to effective cyber security. CAPEC™ helps by providing a comprehensive dictionary of known patterns of attack employed by adversaries to exploit known weaknesses in cyber-enabled capabilities. It can be used by analysts, developers, testers, and educators to advance community understanding and enhance defenses.

National Institute of Standards and Technology (NIST)

Integration Partner

The National Institute of Standards and Technology (NIST) is a non-regulatory federal agency within the U.S. Department of Commerce.

New Context

Commercial Partner

New Context is the security innovator for highly regulated industries. Our products and consulting services enable global leaders in energy, government and across the enterprise to prepare for security orchestration, building critical infrastructure that works with emerging technologies. New Context consultants work as high-value partners of customer security operations, building tools for CTI, security automation & orchestration and data governance.

NL Platform

Community Partner

NL Platform, EclecticIQ and more organizations have created a joint initiative between knowledge institutes and the Dutch government to assist Europe in advancing global cybersecurity ambitions together.

NSFOCUS

Integration Partner

The integration of NSFocus Global Intelligence includes both the feed and enricher. NSFocus Threat Intelligence, with its extensive sources, provides analysts with enricher information for IP addresses, Domains, CVEs and files. The NSFocus API allows analysts to work with the security event data as a feed. The cyber threat landscape in China is larger and more complex than anywhere else. With this integration, analysts have insight into world's largest numbers of Internet-connected devices and, vast numbers of Internet users.

NSFocus

Technology Integration

The integration of NSFocus Global Intelligence includes both the feed and enricher. NSFocus Threat Intelligence, with its extensive sources, provides analysts with enricher information for IP addresses, Domains, CVEs and files. The NSFocus API allows analysts to work with the security event data as a feed. The cyber threat landscape in China is larger and more complex than anywhere else. With this integration, analysts have insight into world's largest numbers of Internet-connected devices and, vast numbers of Internet users.

NTT DATA Intellilink (NDI)

Commercial Partner

NTT DATA INTELLILINK as a platform technology leader in NTT DATA Group, offers consulting and systems integra­tion services delivered by the best pro­fessionals in IT industry across the globe. Our unique capabilities in system platform stack tightly coupled with NTT DATA's deep and broad industry exper­tise.

NVD (National Vulnerability Database)

Technology Integration

The NVD (National Vulnerability Database) Vulnerability Intelligence Feed retrieves CVEs (Common Vulnerability and Exploits) from the NVD CVE API. NVD offers this as a free service -- any customer can use this integration. This integration mainly supports vulnerability management use-cases in the platform.

OASIS CTI Technical Committee

Community Partner

The OASIS Cyber Threat Intelligence (CTI) TC was chartered to define a set of information representations and protocols to address the need to model, analyze, and share cyber threat intelligence.

OpenPhish

Technology Integration

OpenPhish is dedicated to providing timely, accurate, and relevant Phishing Intelligence.

Palo Alto Networks

Integration Partner

This integration harnesses the rich, aggregated threat intelligence from EclecticIQ within Demisto for automated playbook-driven incident data enrichment and response. With Demisto Enterprise, security analysts also get a centralized platform for collaboration, investigation and reporting to facilitate their investigation process and remove the need to pivot between multiple tools.

Palo Alto Networks AutoFocus

Technology Integration

AutoFocus contextual threat intelligence brings speed, consistency and precision to threat investigation. It provides instant access to community-based threat data, enhanced with deep context and attribution from the Unit 42 threat research team, saving time and effort. Now teams can quickly investigate, correlate and pinpoint malware’s root cause without adding dedicated malware researchers or additional tools. Plus, automated protections make it simple to turn raw intelligence into protection across your environment.

PCS Security

Commercial Partner

PCS Security is a Singapore-based solution provider with years of experience and accolades in providing secure, reliable and state-of-the-art security solutions to help our Customers address their security concerns. We deliver full turn-key solutions from design, integration, commissioning to post-implementation maintenance and support.

PhishTank

Technology Integration

PhishTank is a collaborative clearing house for data and information about phishing on the Internet. Also, PhishTank provides an open API for developers and researchers to integrate anti-phishing data into their applications at no charge.

Pink Elephant

Commercial Partner

Pink Elephant is a premier global training, consulting and conference service provider.

Proofpoint

Integration Partner

Proofpoint Emerging Threat (ET) Intelligence delivers the most timely and accurate threat intelligence feeds to identify IPs and domains involved in suspicious and malicious activity and are easily digested by your EclecticIQ

Proximus

Commercial Partner

Proximus is a telecommunication & ICT company operating in the Belgian and international markets, providing services to residential, enterprise and public customers.

Recorded Future

Integration Partner

The Recorded Future integration provides both a feed and enricher capabilities. With the feed, users have access to the Recorded Future Risk List which includes IP and file hashes, for example. The results are provided in standard STIX/TAXII protocols including TTPs and Indicators. The enricher allows users to query Domains, hashes, URLs and IP addresses.

Recorded Future

Technology Integration

The Recorded Future integration provides both a feed and enricher capabilities. With the feed, users have access to the Recorded Future Risk List which includes IP and file hashes, for example. The results are provided in standard STIX/TAXII protocols including TTPs and Indicators. The enricher allows users to query Domains, hashes, URLs and IP addresses.

RIPE NCC

Integration Partner

RIPEstat provides everything you ever wanted to know about IP address space, Autonomous System Numbers (ASNs), and related information for hostnames and countries in one place.

RIPEstat GeoIP / RIPEstat Whois

Technology Integration

RIPEstat provides everything you ever wanted to know about IP address space, Autonomous System Numbers (ASNs), and related information for hostnames and countries in one place.

RiskIQ

Integration Partner

RiskIQ PassiveTotal overcomes the challenges in discovering and proactively blocking malicious infrastructure. Using innovative techniques and research processes, PassiveTotal provides analysts with a single view into all the data they need.

RiskIQ PassiveTotal

Technology Integration

RiskIQ PassiveTotal overcomes the challenges in discovering and proactively blocking malicious infrastructure. Using innovative techniques and research processes, PassiveTotal provides analysts with a single view into all the data they need.

RSA NetWitness / Security Analytics

Technology Integration

Using the NetWitness app, RSA users are able to leverage the power of EclecticIQ Platform directly from the NetWitness interface. Users can receive IOCs from the platform to trigger security alerts, and send sightings back to EclecticIQ Platform.

RSA Security

Integration Partner

Using the NetWitness app, RSA users are able to leverage the power of EclecticIQ Platform directly from the NetWitness interface. Users can receive IOCs from the platform to trigger security alerts, and send sightings back to EclecticIQ Platform.

Security Delta (HSD)

Community Partner

Security Delta (HSD) is the Dutch security cluster. Over 275 companies, governmental organisations and knowledge institutions have been working together since 2014 to make a difference in securing our digitising society.

Shodan

Technology Integration

Shodan is the world's first search engine for Internet-connected devices. The Shodan enricher takes a wealth of input observable types to help you discover which of your devices are connected to the Internet, where they are located, and who is using them.

Silobreaker

Integration Partner

Silobreaker helps business, security and intelligence professionals make sense of the overwhelming amount of unstructured data on the web. By providing powerful tools and visualisations that cut through the noise and analyse data from hundreds of thousands of open sources, Silobreaker makes it easy for users to monitor and research threats or opportunities.

Silobreaker

Technology Integration

Silobreaker helps business, security and intelligence professionals make sense of the overwhelming amount of unstructured data on the web. By providing powerful tools and visualisations that cut through the noise and analyse data from hundreds of thousands of open sources, Silobreaker makes it easy for users to monitor and research threats or opportunities.

SoftwareONE

Commercial Partner

SoftwareONE is a leading global provider of end-to-end software and cloud technology solutions. It enables commercial, technology and digital transformations using IP and technology-driven services. Clients can modernize applications and migrate critical workloads on public clouds while optimizing their related software and cloud assets and licensing in parallel.

Splunk

Integration Partner

The Splunk platform removes the barriers between data and action, empowering observability, IT and security teams to ensure their organizations are secure, resilient and innovative. Founded in 2003, Splunk is a global company — with over 7,500 employees, Splunkers have received over 1,020 patents to date and availability in 21 regions around the world — and offers an open, extensible data platform that supports shared data across any environment so that all teams in an organization can get end-to-end visibility, with context, for every interaction and business process. Build a strong data foundation with Splunk.

Splunk Enterprise Security

Technology Integration

* Operational Intelligence optimizes your IT, security and business performance * Collect operational data (including logs, clickstreams, sensors, stream network traffic, web servers, custom applications, hypervisors, containers, social media and cloud services) * Search, monitor and analyze data to discover powerful insights for security and IT operations. * Understand trends, patterns of activity and behavior to make more informed decision

Splunk SOAR

Technology Integration

Splunk SOAR is a leading Security Orchestration, Automation, and Response (SOAR) Platform. It integrates your team, processes, and tools together. With Splunk SOAR, you’re able to work smarter, respond faster, and strengthen your defenses.

SpyCloud

Integration Partner

The SpyCloud integration feed helps users protect employees and customers. It provides information which can prevent account take over, fraud, IP theft and brand damage. The feed alerts users when an employee's or company's assets have been compromised.

SpyCloud

Technology Integration

The SpyCloud integration feed helps users protect employees and customers. It provides information which can prevent account take over, fraud, IP theft and brand damage. The feed alerts users when an employee's or company's assets have been compromised.

Symantec DeepSight Intelligence Datafeeds

Technology Integration

Leveraging the extensive Symantec Global Intelligence Network, this integration feed allows users to collect raw intelligence data making it available within EclecticIQ Platform. The feed provides a broad range of insights, covering reputation and threat intelligence data for IP, URLs, attacks, bots, cnc, malware, fraud, and phishing.

Syntx

Commercial Partner

Syntx is a knowledge-based cyber security startup, formed by a local group of information technology and cyber security specialist. Syntx is supported by its trusted network of technology partners and service providers that works in collaboration with shared and clear vision of addressing the needs as well as challenges of our customers.

TechLab Security

Commercial Partner

TechLab Securities Sdn Bhd is a team of Security Specialists, passionate in technology, providing solutions for Information Security and Internet Gateway solutions. We have a wide product and services range and have now established ourselves as a leading Enterprise Systems Integrator and Solutions provider. Our solutions and services are sought after by customers from different backgrounds. This vindicates the quality of our offering and shows how we have successfully customised solutions to suit the needs of the niche industries we are present in.

The National Cyber-Forensics and Training Alliance (NCFTA)

Technology Integration

The NCFTA was created by industry, academia, and law enforcement for the sole purpose of establishing a neutral, trusted environment that enables two-way information sharing with the ultimate goal to identify, mitigate, disrupt, and neutralize cyber threats.

Threat Crowd

Technology Integration

ThreatCrowd is an Open Source system for finding and researching artefacts relating to cyber threats, utilizing information obtained by crawling various Open Source resources, including VirusTotal and Malwr.ThreatCrowd is an Open Source system for finding and researching artefacts relating to cyber threats, utilizing information obtained by crawling various Open Source resources, including VirusTotal and Malwr.r

Trusted Cyber Security Solutions (TCSS)

Commercial Partner

TCSS offers a wide range of cybersecurity services from creating and updating strategy, consulting and managed services to training and forensics.

Vigilante

Technology Integration

Vigilante is a global threat hunting and dark web cyber intelligence research team, delivering a combination of vast, unique human intelligence and automation that is targeted for each client to help them identify their biggest risks and defend against the most sophisticated adversaries.

VirusTotal

Technology Integration

With VirusTotal users can analyze suspicious files and URLs. It facilitates the quick identification of viruses, worms, trojans and all kinds of malware. Integrating VirusTotal means that users don’t need to leave EclecticIQ Platform – everything is at your fingertips which saves time and minimizes the number of tools open at once. The integration supports the premium service for feeds and enrichers; plus, the free service for enrichers. VirusTotal helps users by providing more condensed, ingestible and corroborable information.

VMRay

Integration Partner

Surmounting the persistent shortcomings of other DFIR tools, VMRay delivers rapid detection results and in-depth analysis reports without compromising performance or security. VMRay flexibly integrates with other systems, automating the submission of files and URLs for analysis. Precise, actionable results are returned that drive block/allow decisions and other security measures across the enterprise.

VMRay

Technology Integration

Surmounting the persistent shortcomings of other DFIR tools, VMRay delivers rapid detection results and in-depth analysis reports without compromising performance or security. VMRay flexibly integrates with other systems, automating the submission of files and URLs for analysis. Precise, actionable results are returned that drive block/allow decisions and other security measures across the enterprise.

Webroot

Technology Integration

Webroot, an OpenText company, was the first to harness the cloud and artificial intelligence to stop zero-day threats in real time. Webroot secures businesses and individuals worldwide with threat intelligence and protection for endpoints and networks.

Zscaler

Technology Integration

Zscaler accelerates digital transformation so that customers can be more agile and secure. The Zscaler Zero Trust Exchange, a SASE-based platform, is the world’s largest inline cloud security platform, protecting thousands of customers from cyberattacks and data loss by securely connecting users, devices, and applications over any network. Zscaler integrates with EclecticIQ by consuming high-confidence indicators to enforce real-time policies and ensure all users get complete protection from emerging threats and targeted attacks.