EclecticIQ Platform Integrations

The AlienVault Open Threat Exchange (OTX) is a system for sharing threat intelligence among OSSIM users and AlienVault customers.

BFK is in the field of malware analysis and incident response since 1990. It offers threat intel feeds, passive DNS, and enrichment APIs, that make use of up-to-date collection of static and dynamic sample analyses. The company‘s prime focus is crimeware and APT attacks.

Artillery is a combination of a honeypot, monitoring tool, and alerting system. Eventually this will evolve into a hardening monitoring platform as well to detect insecure configurations from nix systems.

The Bitdefender Advanced Threat Intelligence solution helps security professionals gain visibility into the latest threats by using up-to-date, contextual intelligence on URLs, IPs, domains, certificates, files, Command and Control servers and Advanced Persistent Threats.

AnubisNetworks Cyberfeed allows customers to obtain threat intelligence on real-time security events, with monitoring of countries, organizations and their subsidiaries.

Censys is an Internet-wide scanning system and database that aims at listing all devices and networks that compose the Internet. Censys lets researchers find specific hosts and create aggregate reports on how devices, websites, and certificates are configured and deployed.

Take faster action on newly discovered malicious domains by leveraging a turn-key integration between Cisco and OpenDNS. Through security automation, dwell time is reduced from hours or days to only minutes. And by gaining Internet-wide visibility in real-time, you will discover more compromised systems.c

Cisco Threat Grid analyzes suspicious behavior in your network against more than 450 behavioral indicators and a malware knowledge base sourced from around the world. Threat Grid content feeds are pre-generated, curated sets of behavioural indicators that are produced in the Threat Grid Cloud infrastructure from sample analysis results. Feeds are used by organizations and partners for targeted threat intelligence, by focusing on the specific types of threats faced by particular industries.

The Cisco Umbrella API helps analysts quickly understand registration details, similar domains and potential malicious ties to observable data. With this integration, analysts can quickly discern threats and attribution intelligence from observables used in active campaigns as the cloud-based enricher provides information relating domains, IP addresses and file hashes. Combining this integration with EclecticIQ Platform enables analysts to dynamically build a repository of intelligence relating to domain activity.

Cofense PhishMe is the leading provider of human-driven phishing defense solutions worldwide. Our collective defense suite combines best-in class incident response technologies with timely attack intelligence sourced from employees. Cofense enables thousands of global organizations to stop attacks in progress faster and stay ahead of breaches.

Crowdstrike is a global leader in the cloud-delivered next-generation endpoint protection. With a single lightweight agent, CrowdStrike is the first company to unify next-generation antivirus that includes machine learning and behavioral analytics, endpoint detection and response (EDR), and a 24/7 managed hunting service all in one lightweight agent. Falcon Intelligence^TM is a cost-effective program tailored to each company’s needs and requirements and addresses the legal and technical aspects of preventing harm that results from a cyberattack.

Digital Shadows SearchLight protects against external threats, continually identifying where your assets are exposed, providing sufficient context to understand the risk, and options for remediation.

DomainTools helps security analysts turn threat data into threat intelligence. We take indicators from your network and connect them with nearly every active domain on the Internet. Fortune 1000 companies, global government agencies, and leading security solution vendors use the DomainTools platform as a critical ingredient in their threat investigation and mitigation work.

DomainTools helps security analysts turn threat data into threat intelligence. We take indicators from your network and connect them with nearly every active domain on the Internet. Fortune 1000 companies, global government agencies, and leading security solution vendors use the DomainTools platform as a critical ingredient in their threat investigation and mitigation work.

As a leading provider of industrial control systems cybersecurity, the Dragos threat detection and response platform codifies decades of real-world experience in advanced threat analytics. It provides operational and information technology practitioners unprecedented visibility and prescriptive procedures to respond to adversaries in the industrial threat landscape. Through the integration with EclecticIQ Platform, Threat Intelligence Analysts now have access to relevant reports, Indicators, Threat Actors, TTPs and observables that Dragos provides for this unique threat landscape.

The Browser Extension is an add-on for your web browser, specifically made for EclecticIQ Platform. It lets analysts quickly and easily process both external threat data found in human-written reports and machine-generated data from internal security controls. Analysts can capture the data, structure it and subsequently ingest it into their Platform in one flow, without ever leaving the page they are on.

Any data provided in STIX (1.0, 1.1.1, 1.2) format, including FS-ISAC and MISP feeds.

Soltra Edge collects threat intelligence from various sources and converts it into open standards STIX and TAXII, revealing information that helps firms make decisions on what actions they need to take to help users better protect their organizations against cyber threats.

Exodus Intelligence provides clients with actionable information, capabilities, and context for proven exploitable vulnerabilities. Their world class team of vulnerability researchers discover hundreds of exclusive Zero-Day vulnerabilities, providing their clients with this knowledge before the adversaries find them. Their research also extends into N-Day research.

Farsight Security DNSDB is a Passive DNS historical database that provides a unique, fact-based, multifaceted view of the configuration of the global Internet infrastructure. DNSDB leverages the richness of Farsight’s Security Information Exchange (SIE) data-sharing platform and is engineered and operated by leading DNS experts.

FireEye iSIGHT Intelligence is a proactive, forward-looking means of qualifying threats poised to disrupt your business based on the intents, tools and tactics of the attacker. Our high-fidelity, comprehensive intelligence delivers visibility beyond the typical attack lifecycle, adding context and priority to global threats before, during and after an attack. It helps mitigate risk, bolster incident response, and enhance your overall security ecosystem.

Flashpoint is the market leader in threat intelligence from the Deep and Dark Web. Flashpoint’s products illuminate threatening actors, relationships, behaviors, and networks.

InTELL tracks global criminal activity with intelligence based on actor attribution and context. Going beyond botnet & malware information, InTELL provides a global picture of trends, geographical activity, actors, their motivations and their evolving business models. Real-time contextual cyber intelligence includes global visibility on actor trends, threats and technology; tracking of risks and threats to online brands; and contextual threat feeds.

GreyNoise empowers users to differentiate between targeted cyber-attacks and pointless alerts generated by Internet-wide scan and attack activity. Think of GreyNoise as Anti-Threat Intelligence, telling you what not to worry about so you can focus on the activity that matters.

Group-IB is a global provider of security services and threat intelligence solutions with profound expertise providing the global security community insights into Russian-speaking cyber criminal groups and their tactics.

Hail a TAXII.com is a repository of Open Source Cyber Threat Intellegence feeds in STIX format.

The Central Ops.net integration enables analysts to investigate domains and IP addresses. This enricher provides registrant information, DNS records and more. All the information is delivered all in one report; making it much quicker and easier for the analyst. Unlike the free service, this paid account means that there is no limit on the amount of times you need to access the tool.

This niche supplier is a must have when it comes to securing critical infrastructure sectors, which support our everyday lives. Honeypot.dk offers a number of industrial control systems (ICS) and SCADA (Supervisory Control and Data Acquisition) threat feeds in the following industries: energy, transportation, healthcare, water and waste water management, as well as other types of industrial manufacturing. The integration with EclecticIQ Platform allows customers to ingest these threat feeds and convert them into relevant TTPs, Attack Patterns, and Indicators, enabling their analysts to build actionable threat intelligence with a real-life perspective.

Free automated malware analysis.

The Data Exchange Layer (DXL) communication fabric connects and optimizes security actions across multiple vendor products, as well as internally developed and open source solutions. Enterprises gain secure, real-time access to new data and lightweight, instant interactions with other products. New integration with Cisco pxGrid extends your reach end-to-end with better identity services and automated threat mitigation.

McAfee Threat Intelligence Exchange (TIE) acts as a broker that combines intelligence from local security solutions. With this integration, EclecticIQ Platform users can query McAfee TIE and ingest and leverage this intelligence in their threat analysis workflows.

Intel 471 provides Adversary and Malware Intelligence for leading intelligence, security and fraud teams. Adversary Intelligence is focused on infiltrating and maintaining access to closed sources where threat actors collaborate, communicate and plan cyber-attacks. Malware Intelligence leverages our underground access to provide timely data and context on malware and adversary infrastructure.

Intel 471 provides Adversary and Malware Intelligence for leading intelligence, security and fraud teams. Adversary Intelligence is focused on infiltrating and maintaining access to closed sources where threat actors collaborate, communicate and plan cyber-attacks. Malware Intelligence leverages our underground access to provide timely data and context on malware and adversary infrastructure.

Exclusive, proactive access to Kaspersky’s most recent investigations and insights, revealing the methods, tactics and tools used by APT actors in high-profile cyberespionage campaigns with cross-sector targeting. Information provided in these reports allows to improve threat hunting missions and develop effective security use cases for proactive defense.

Context-rich and immediately actionable threat intelligence feeds containing information on suspicious and dangerous IPs, URLs and file hashes, enable efficient alert triage process while providing enough context to immediately identify alerts that need to be investigated or escalated to incident response team.

All the knowledge acquired by Kaspersky about cyberthreats, legitimate objects and their various relationships, brought together into a single, powerful web service. Real-time search of many petabytes of threat relationship data enables highly effective incident investigations and threat hunting.

MaxMind an industry-leading provider of IP intelligence. EclecticIQ Platform users can leverage GeoIP databases to enrich and develop context on their IP feeds.

The integration of NSFocus Global Intelligence includes both the feed and enricher. NSFocus Threat Intelligence, with its extensive sources, provides analysts with enricher information for IP addresses, Domains, CVEs and files. The NSFocus API allows analysts to work with the security event data as a feed. The cyber threat landscape in China is larger and more complex than anywhere else. With this integration, analysts have insight into world's largest numbers of Internet-connected devices and, vast numbers of Internet users.

The NVD (National Vulnerability Database) Vulnerability Intelligence Feed retrieves CVEs (Common Vulnerability and Exploits) from the NVD CVE API. NVD offers this as a free service -- any customer can use this integration. This integration mainly supports vulnerability management use-cases in the platform.

AutoFocus contextual threat intelligence brings speed, consistency and precision to threat investigation. It provides instant access to community-based threat data, enhanced with deep context and attribution from the Unit 42 threat research team, saving time and effort. Now teams can quickly investigate, correlate and pinpoint malware’s root cause without adding dedicated malware researchers or additional tools. Plus, automated protections make it simple to turn raw intelligence into protection across your environment.

The Recorded Future integration provides both a feed and enricher capabilities. With the feed, users have access to the Recorded Future Risk List which includes IP and file hashes, for example. The results are provided in standard STIX/TAXII protocols including TTPs and Indicators. The enricher allows users to query Domains, hashes, URLs and IP addresses.

RiskIQ PassiveTotal overcomes the challenges in discovering and proactively blocking malicious infrastructure. Using innovative techniques and research processes, PassiveTotal provides analysts with a single view into all the data they need.

SenseCy (a Verint Company) is a leading Israeli provider of actionable Cyber Threat Intelligence (CTI) solutions, relying on a unique Virtual HUMINT-based methodology that combines highly skilled analysts with advanced domain expertise and proficiency in over 15 languages, and the most advanced Web Intelligence (WEBINT) systems on the market by Verint, providing multiple platforms for the automatic collection and analysis of Actionable Intelligence® from the entire web.

Shodan is the world's first search engine for Internet-connected devices. The Shodan enricher takes a wealth of input observable types to help you discover which of your devices are connected to the Internet, where they are located, and who is using them.

Silobreaker helps business, security and intelligence professionals make sense of the overwhelming amount of unstructured data on the web. By providing powerful tools and visualisations that cut through the noise and analyse data from hundreds of thousands of open sources, Silobreaker makes it easy for users to monitor and research threats or opportunities.

The SpyCloud integration feed helps users protect employees and customers. It provides information which can prevent account take over, fraud, IP theft and brand damage. The feed alerts users when an employee's or company's assets have been compromised.

ThreatCrowd is an Open Source system for finding and researching artefacts relating to cyber threats, utilizing information obtained by crawling various Open Source resources, including VirusTotal and Malwr.ThreatCrowd is an Open Source system for finding and researching artefacts relating to cyber threats, utilizing information obtained by crawling various Open Source resources, including VirusTotal and Malwr.r

ThreatFabric experts are actively helping the financial industry with cyber security and threat intelligence solutions to pro-actively detect known and unknown threats in order to mitigate fraud and deflect risk. MTI provides visibility on the mobile threat-landscape: Malware payloads, botnets and campaigns, C2 infrastructure, actors and Modus Operandi, all the dots are connected to provide the right context to fight cybercrime.

Vigilante is a global threat hunting and dark web cyber intelligence research team, delivering a combination of vast, unique human intelligence and automation that is targeted for each client to help them identify their biggest risks and defend against the most sophisticated adversaries.

With VirusTotal users can analyze suspicious files and URLs. It facilitates the quick identification of viruses, worms, trojans and all kinds of malware. Integrating VirusTotal means that users don’t need to leave EclecticIQ Platform – everything is at your fingertips which saves time and minimizes the number of tools open at once. The integration supports the premium service for feeds and enrichers; plus, the free service for enrichers. VirusTotal helps users by providing more condensed, ingestible and corroborable information.

Wapack Labs identifies cyber threats before they become attacks, providing threat detection through internet surveillance operations, data gathering, and in-depth analysis of economic, financial, and geopolitical issues.

Webroot, an OpenText company, was the first to harness the cloud and artificial intelligence to stop zero-day threats in real time. Webroot secures businesses and individuals worldwide with threat intelligence and protection for endpoints and networks.