Threat Intel Preview
Threat Intel is in preview. Here is what the page is for and what to rely on today.
This capability is not generally available yet. This page describes what is coming, and details may change before release.
Overview
Threat Intel is not yet connected to live threat data or to your environment. The campaigns, indicators and verdicts on the page are sample content, and its action buttons do not act yet. Do not use it for incident decisions.
Threat Intel, under Intelligence > Threat Intel, is intended to answer one question: who is targeting you, and what are they using. It will list threat campaigns with their actor, severity, MITRE ATT&CK techniques and indicators of compromise, ranked by relevance to your industry.
What is coming
- Campaigns relevant to your industry, with the actor behind each one and the techniques they use.
- Indicators of compromise (IP addresses, domains, file hashes and email addresses) for each campaign.
- Recommended actions that help you prioritize hardening against the techniques in use.
Seeing the page needs Intelligence > Threat Intel: Read.
What to rely on today
- Surface Intelligence for hosts you own that are exposed but not yet under test, including takeover risk and known CVEs on their technology.
- Exposure for every in-scope target and its open findings.
- Delivery boards for findings PENOPS agents have confirmed in your environment.