Security operations
Threat intelligence
Intelligence is only useful when it changes a decision. Practise the full loop here: ingest indicators, judge their confidence, match them against your own telemetry, and promote the durable ones into detection logic.
Indicators tracked
44,367
Matched in our data
7
Feeds connected
4
Promoted to detections
2
indicator → durable behavioural rule
Indicator repository
Only indicators observed in this environment are shown.
| Indicator | Type | Verdict | Confidence | Sightings | Tags |
|---|---|---|---|---|---|
| cdn-update-sync.net | domain | Malicious | 148 | c2 · beaconing | |
| 203.0.113.77 | ip | Malicious | 96 | c2 · hosting-abuse | |
| be40b1c2…7d13 | hash | Malicious | 3 | dropper · persistence | |
| hxxps://acme-payroll-login[.]com/session | url | Malicious | 21 | credential-harvest · initial-access | |
| 198.51.100.23 | ip | Suspicious | 512 | scanning | |
| office-doc-preview.co | domain | Suspicious | 7 | lure | |
| 10.30.1.5 | ip | Benign | 4210 | internal · known-good | |
| c012ef99…be55 | hash | Malicious | 1 | webshell |
Indicator detail
cdn-update-sync.net
Fixed-interval DNS lookups from a single workstation; jitter under 4%.
Sources
Community feed, Internal hunt
Connected feeds
Community indicator exchange
Healthy41,280 indicators · every 15 min · updated 4 min ago
Sector sharing group
Healthy2,891 indicators · every hourly · updated 22 min ago
Internal hunt findings
Healthy132 indicators · every on write · updated 1 min ago
Sandbox detonations
Degraded64 indicators · every on demand · updated 38 min ago
Adversary profiles
Generic, behaviour-first profiles — no attribution guesswork required.
Commodity loader crews
FinancialHigh volume, low sophistication; caught by script-host detections.
targets: Finance and HR mailboxes · T1566.001 · T1059.001 · T1547.001
Access brokers
ResalePassword spraying followed by quiet, low-and-slow logons.
targets: Remote access endpoints · T1110.003 · T1078 · T1021.001
Extortion operators
RansomCredential theft precedes encryption by days — hunt the middle.
targets: File servers and backups · T1003.001 · T1486 · T1490
The pyramid of pain, appliedmethod›
Blocking a hash costs the attacker a recompile. Blocking a domain costs a registration. Detecting the behaviour — a script host writing an executable into a roaming profile and then resolving a fresh domain on a fixed interval — costs them a redesign. Use indicators for fast wins and retrospective searching; use behaviour for detections you keep.
Scoring confidence before you act›
- How many independent sources report it, and are they actually independent or reselling one feed?
- How old is the observation? Infrastructure rotates in days.
- Is the indicator specific, or shared hosting that would generate mass false positives?
- Does your own telemetry corroborate it? One local sighting outweighs three anonymous feed entries.
Retrospective hunting on new indicators›
Every high-confidence indicator should trigger a look back across the full retention window, not just forward-looking blocking. An indicator published today often first appeared in your data weeks ago — that gap is the dwell time you are trying to shrink.
Learn this capability
Hands-on labs that build the technique behind this workspace. Skills transfer to any mainstream SIEM.
Advanced · Theory · 20 min
Hunting methodology
No alert has fired, but you suspect something detection does not cover. Hunting starts with a hypothesis you can prove or disprove with data you actually have.
Advanced · Simulation · 50 min
Hunt: beaconing in DNS
Hypothesis: an implant on the estate is beaconing over DNS at a fixed interval to a recently registered domain. Prove or disprove it.
Entry · Theory · 16 min
Speaking ATT&CK
Three critical alerts are open. Each describes a different attacker goal. To discuss them with anyone else in security you need the ATT&CK vocabulary.