Alternatives to OpenCTI
Compare OpenCTI alternatives for your business or organization using the curated list below. SourceForge ranks the best alternatives to OpenCTI in 2026. Compare features, ratings, user reviews, pricing, and more from OpenCTI competitors and alternatives in order to make an informed decision for your business.
-
1
ManageEngine Log360
Zoho
Detect, investigate, and resolve security incidents and threats using a single, scalable SIEM solution. Log360 provides you with actionable insights and analytics-driven intelligence for real-time security monitoring, advanced threat detection, incident management, and behavioral analytics-based anomaly detection. Built as the bedrock for your SOC, ManageEngine Log360 comes with out-of-the-box correlation and workflow rules, dashboards, reports, and alert profiles to help you address vital security issues with little manual intervention. -
2
ManageEngine EventLog Analyzer
ManageEngine
ManageEngine EventLog Analyzer is an on-premise log management solution designed for businesses of all sizes across various industries such as information technology, health, retail, finance, education and more. The solution provides users with both agent based and agentless log collection, log parsing capabilities, a powerful log search engine and log archiving options. With network device auditing functionality, it enables users to monitor their end-user devices, firewalls, routers, switches and more in real time. The solution displays analyzed data in the form of graphs and intuitive reports. EventLog Analyzer's incident detection mechanisms such as event log correlation, threat intelligence, MITRE ATT&CK framework implementation, advanced threat analytics, and more, helps spot security threats as soon as they occur. The real-time alert system alerts users about suspicious activities, so they can prioritize high-risk security threats. -
3
Recorded Future
Recorded Future
Recorded Future is the world’s largest provider of intelligence for enterprise security. By combining persistent and pervasive automated data collection and analytics with human analysis, Recorded Future delivers intelligence that is timely, accurate, and actionable. In a world of ever-increasing chaos and uncertainty, Recorded Future empowers organizations with the visibility they need to identify and detect threats faster; take proactive action to disrupt adversaries; and protect their people, systems, and assets, so business can be conducted with confidence. Recorded Future is trusted by more than 1,000 businesses and government organizations around the world. The Recorded Future Security Intelligence Platform produces superior security intelligence that disrupts adversaries at scale. It combines analytics with human expertise to unite an unrivaled variety of open source, dark web, technical sources, and original research. -
4
Threat Landscape
Ecliptica Labs AB
Threat Landscape is an automated threat intelligence platform built for security analysts and SOC teams who need high-confidence, actionable intelligence — without the manual triage. The platform continuously ingests and processes global OSINT and darknet sources, automatically extracting structured facts and filtering out noise before it reaches analysts. All intelligence is normalized into STIX 2.1 format, MITRE ATT&CK mapped, and correlated across threat actors, malware families, CVEs, TTPs, and IOCs — so teams spend time acting on intelligence, not building it. Key capabilities include interactive dashboards, visualized STIX threat graphs, advanced search and filtering, darknet monitoring for leak-site claims and criminal chatter, automated daily and weekly digests, and a RESTful API for integration with SIEM, SOAR, and TIP platforms.Starting Price: $499/month -
5
Extend your security intelligence from local network to global cyberspace. Get in-depth, up-to-date global knowledge about specific threats and attack sources, which can be difficult to obtain if you only have access to information within your own networks. ESET Threat Intelligence data feeds utilize widely supported STIX and TAXII formats, which makes it easy to integrate with existing SIEM tools. Integration helps to deliver the latest information on the threat landscape to predict and prevent threats before they strike. ESET Threat Intelligence features a full API that is available for automation of reports, YARA rules and other functionalities to allow for integration with other systems used within organizations. These allow organizations to set up custom rules to obtain company-specific information that security engineers are interested in. Organizations receive valuable details such as the number of times specific threats have been seen worldwide.Starting Price: $132
-
6
Cyware
Cyware
Cyware is the only company building Virtual Cyber Fusion Centers enabling end-to-end threat intelligence automation, sharing, and unprecedented threat response for organizations globally. Cyware offers a full-stack of innovative cyber fusion solutions for all-source strategic, tactical, technical and operational threat intelligence sharing & threat response automation. Cyware’s Enterprise Solutions are designed to promote secure collaboration, inculcate cyber resilience, enhance threat visibility and deliver needed control by providing organizations with automated context-rich analysis of threats for proactive response without losing the element of human judgment. Cyware solutions are pushing the boundaries of current security paradigms by utilizing advances in Machine Learning, Artificial Intelligence, Security Automation & Orchestration technologies to empower enterprises in adapting to the evolving threat landscape. -
7
Filigran
Filigran
Embrace a proactive approach with end-to-end cyber threat management, from anticipation to response. Tailored to elevate cybersecurity through comprehensive threat intelligence, advanced adversary simulation, and strategic cyber risk management solutions. Get a holistic view of your threat environment and improved decision-making for faster incident response. Organize your cyber threat intelligence knowledge to enhance and disseminate actionable insights. Access consolidated view of threat data from multiple sources. Transform raw data into actionable insights. Enhance sharing and actionable insights dissemination across teams and tools. Streamline incident response with powerful case management capabilities. Create dynamic attack scenarios, ensuring accurate, timely, and effective response during real-world incidents. Build both simple and intricate scenarios tailored to various industry needs. Improve team dynamics with instant feedback on responses. -
8
Group-IB Threat Intelligence
Group-IB
Defeat threats efficiently and identify attackers proactively with a revolutionary cyber threat intelligence platform by Group-IB. Capitalize on your threat intelligence insights with Group-IB’s platform. Group-IB Threat Intelligence provides unparalleled insight into your adversaries and maximizes the performance of every component of your security with strategic, operational, and tactical intelligence. Maximize known and unlock hidden values of intelligence with our threat intel platform. Understand threat trends and anticipate specific cyber attacks with thorough knowledge of your threat landscape. Group-IB Threat Intelligence provides precise, tailored, and reliable information for data-driven strategic decisions. Strengthen defenses with detailed insight into attacker behaviors and infrastructure. Group-IB Threat Intelligence delivers the most comprehensive insight into past, present, and future attacks targeting your organization, industry, partners, and clients. -
9
Google Threat Intelligence
Google
Get comprehensive visibility and context on the threats that matter most to your organization. Google Threat Intelligence provides unmatched visibility into threats enabling us to deliver detailed and timely threat intelligence to security teams around the world. By defending billions of users, seeing millions of phishing attacks, and spending hundreds of thousands of hours investigating incidents we have the visibility to see across the threat landscape to keep the most important organizations protected, yours. Focus on the most relevant threats to your organization by understanding the threat actors and their ever changing tactics, techniques, and procedures (TTPs). Leverage these insights to proactively set your defenses, hunt efficiently, and respond to new and novel threats in minutes. -
10
DeCYFIR
CYFIRMA
We go to the hackers’ trenches, discover, analyze, correlate, and find the deepest insights from noisy data. Receive comprehensive cyber intelligence that covers beyond tactical approach; our insights include management and strategic intelligence that is applicable across the organization. We correlate data against your industry, geography and technology to give you remediation recommendations, prioritized for swift actions. Quality cyber intelligence requires deep technology to decode signals from a multitude of sources. By converting discovery to useful insights, the Threat Visibility and Intelligence module is the essential cybersecurity ammunition to keep any organization’s security posture robust. The threat visibility and Intelligence module is a powerful platform where data is collected, analyzed, correlated against key attributes and presented in a format where both security practitioners and business leaders can take decisive actions. -
11
ThreatStream
Anomali
Anomali ThreatStream is a Threat Intelligence Platform that aggregates threat intelligence from diverse sources, provides an integrated set of tools for fast, efficient investigations, and delivers operationalized threat intelligence to your security controls at machine speed. ThreatStream automates and accelerates the process of collecting all relevant global threat data, giving you the enhanced visibility that comes with diversified, specialized intelligence sources, without increasing administrative load. Automates threat data collection from hundreds of sources into a single, high fidelity set of threat intelligence. Improve your security posture by diversifying intelligence sources without generating administrative overhead. Easily try and buy new sources of threat intelligence via the integrated marketplace. Organizations rely on Anomali to harness the power of threat intelligence to make effective cybersecurity decisions that reduce risk and strengthen defenses. -
12
Trellix ATLAS
Trellix
Giving customers a unique insight into malicious files, domains, and IP detections seen worldwide. Advanced Threat Landscape Analysis System (ATLAS) data is aggregated from various Trellix data sources to provide the latest global emerging threats with enriched data such as industry sector and geolocation. ATLAS correlates these threats with campaign data containing research from Trellix’s Advanced Research Center (ARC) and Threat Intelligence Group (TIG), as well as open source data, to provide a dedicated view for campaigns consisting of events, dates, threat actors, IOCs, and more. Enables customers with unique global insight into the malicious threat detections seen worldwide by Trellix. Geospatially enabled situational awareness. Utilizes the Trellix telemetry data collected worldwide. Highlights current and emerging threats by highlighting those of particular interest by type, industry sector, geolocation, most seen, etc. -
13
Real-time monitoring and analysis allowing you to quickly prioritize, investigate, and respond to hidden threats. A central view of potential threats with built-in workflows removes the complexity of threat protection. Be ready anytime for the audit with automated compliance. Get greater transparency monitoring users, applications, networks and devices. Data correlated and enriched to deliver purposeful intelligence on the threat and how to mitigate. Real-time threat identification and response powered by advanced threat intelligence reduces lead time to protect against threats such as phishing, insider threats, data exfiltration and Distributed Denial of Service (DDOS) attacks.
-
14
Threat Intelligence Platform
Threat Intelligence Platform
Threat Intelligence Platform combines several threat intelligence sources to provide in-depth insights on threat hosts and attack infrastructure. Correlating threat information from various feeds with our exhaustive in-house databases, a result of 10+ years of data crawling, the platform performs real-time host configuration analyses to come up with actionable threat intelligence that is vital in detection, mitigation, and remediation. Find detailed information about a host and its underlying infrastructure in seconds through the Threat Intelligence Platform web interface. Integrate our rich data sources into your systems to enrich results with additional threat intelligence insights. Integrate our capabilities into existing cybersecurity products, including cyber threat intelligence (CTI) platforms, security information and event management (SIEM) solutions, digital risk protection (DRP) solutions, and more.Starting Price: $12.5 per month -
15
LifeRaft Navigator
Navigator
Consolidate, assess, and investigate intelligence in a single platform. Collect and alert on data relevant to your security operations from social media, deep web, and darknet sources 24/7. Our unified intelligence platform automates collection and filtering, and provides a suite of investigative tools to explore and validate threats. Uncover critical information that impacts the security of your assets and operations. Navigator monitors the internet 24/7 with custom search criteria to detect high-risk threats to your people, assets, and operations from diversified sources. Finding the needle in the haystack is a growing challenge for security operations teams. Navigator provides advanced filtering tools to capture the breadth of the online threat landscape. Uncover, explore, and use a variety of sources to validate intelligence related to threat actors, events, and special interest projects or security issues. -
16
ThreatQ
ThreatQuotient
Threat intelligence platform - ThreatQ, to understand and stop threats more effectively and efficiently your existing security infrastructure and people need to work smarter, not harder. ThreatQ can serve as an open and extensible threat intelligence platform that accelerates security operations through streamlined threat operations and management. The integrated, self-tuning threat library, adaptive workbench and open exchange allow you to quickly understand threats, make better decisions and accelerate detection and response. Automatically score and prioritize internal and external threat intelligence based on your parameters. Automate aggregation, operationalization and use of threat intelligence across all systems and teams. Improve effectiveness of existing infrastructure by integrating your tools, teams and workflows. Centralize threat intelligence sharing, analysis and investigation in a threat intelligence platform all teams can access. -
17
Base Operations
Base Operations
Increase your knowledge of every corner of the world by harnessing the power of street-level threat intelligence. Access crime and unrest data of unparalleled granularity to evaluate threats before incidents occur. Apply recent and historical data to identify patterns, analyze trends, and contextualize information. Better understand areas of strategic importance to keep people safe and assets secure. Leverage intelligence gathered from thousands of public and proprietary sources to analyze the threat landscape at the street level. Quickly identify patterns and trends in a hyperlocal area to anticipate future developments. Launch with swift onboarding and an intuitive interface, progressing toward security priorities on the first day of implementation. Base Operations is like having a team of data scientists behind each member of the corporate security team. Assessments, briefings, and recommendations are supercharged with the world’s most comprehensive threat data and trend analysis. -
18
Proofpoint Emerging Threat (ET) Intelligence
Proofpoint
Proofpoint ET Intelligence delivers the most timely and accurate threat intelligence. Our fully verified intel provides deeper context and integrates seamlessly with your security tools to enhance your decision-making. Knowing what types of threats exist is no longer enough to protect your people, data, and brand. Emerging Threat (ET) intelligence helps prevent attacks and reduce risk by helping you understand the historical context of where these threats originated, who is behind them, when have they attacked, what methods they used, and what they're after. Get on-demand access to current and historical metadata on IPs, domains, and other related threat intelligence to help research threats and investigate incidents. In addition to reputation intel, you get condemnation evidence, deep context, history, and detection information. It's all searchable in an easy-to-use threat intelligence portal that includes: Trends and timestamps of when a threat was seen and the associated category. -
19
Bitdefender Advanced Threat Intelligence
Bitdefender
Fueled by the Bitdefender Global Protective Network (GPN), Bitdefender Advanced Threat Intelligence collects data from sensors across the globe. Our Cyber-Threat Intelligence Labs correlate hundreds of thousands of Indicators of Compromise and turn data into actionable, real-time insights. By delivering our top-rated security data and expertise directly to businesses and Security Operations Centers, Advanced Threat Intelligence bolsters security operations success with one of the industry’s broadest and deepest bases of real-time knowledge. Improve threat-hunting and forensic capabilities with contextual, actionable threat indicators on IPs, URLs, domains and files known to harbor malware, phishing, spam, fraud and other threats. Decrease time to value by seamlessly integrating our platform-agnostic Advanced Threat Intelligence services into your security architecture, including SIEM, TIP and SOAR. -
20
Palo Alto Networks AutoFocus
Palo Alto Networks
Tomorrow's operations depend on unrivaled threat intelligence, today. Power up investigation, prevention and response with AutoFocus. Palo Alto Networks, provider of the industry-leading next-generation firewall, has made the world’s highest-fidelity repository of threat intelligence, sourced from the largest network of sensors, available for any team or tool to consume. AutoFocus™ contextual threat intelligence service is your one-stop shop for threat intelligence. Your teams will receive instant understanding of every event with unrivaled context from Unit 42 threat researchers, and you can embed rich threat intelligence in analyst’s existing tools to significantly speed investigation, prevention, and response. Get unique visibility into attacks crowdsourced from the industry’s largest footprint of network, endpoint, and cloud intel sources. Enrich every threat with the deepest context from worldrenowned Unit 42 threat researchers. -
21
Global Threat Intelligence (GTI) is a comprehensive, real-time, cloud-based reputation service, fully integrated into Trellix products. Protects organizations and their users from both known and emerging cyber threats, regardless of the source of those threats or where they propagate. Arms your security infrastructure with shared threat intelligence, enabling security products to act in concert, based on the same robust, real-time information. Closes the threat window with instantaneous, and often predictive, reputation-based threat intelligence, reducing the probability of attack and cost of remediation and lost downtime. Threat data is collected from billions of Trellix product sensor queries around the globe and correlated to produce our threat intelligence. Trellix products query GTI in the cloud, and GTI renders the latest reputation or categorization intelligence to the products so that they can take action.
-
22
NETSCOUT Omnis Security
Netscout
Doing business in a digital economy requires agility, and corporate digital structures have changed significantly to provide it. However, as companies rush to transition to the cloud and expand activities in a globally distributed digital ecosystem, they must also reinvent cybersecurity to defend against emerging threats. NETSCOUT Omnis Security is an advanced attack analysis and response platform that provides the scale, scope, and consistency needed to protect today's digital infrastructure. Highly scalable network instrumentation that offers a comprehensive view of all distributed digital infrastructures. Threat detection with selected intelligence, behavioral analytics, open source data, and advanced statistics. Contextual threat detection and investigation using a robust source of metadata and packages. Automated edge blocking with the best stateless packet processing technology, or third-party blocking devices. -
23
C-Prot Threat Intelligence Portal is a powerful web service for providing access to information about cyber threats. C-Prot Threat Intelligence Portal offers the possibility to check different types of suspicious threat indicators such as files, file signatures, IP addresses, or web addresses. In this way, institutions are informed about potential threats and can take necessary precautions. Detect advanced threats using our advanced detection technologies, including dynamic, static, and behavioral analysis, and our global cloud reputation system with the C-Prot Threat Intelligence Portal. Access detailed information on specific malware indicators, as well as the tools, tactics, and attack types used by cyber attackers. Check for different indicators of suspicious threats such as IP address and web address. Understand threat trends and anticipate specific attacks with complete knowledge of your threat environment.Starting Price: Free
-
24
Nisos
Nisos
Safeguard what matters most and inform critical decisions with deep digital investigations and open source threat intelligence services. Stay ahead of threats to protect your people, assets, and reputation with Nisos’ expert insights. Best practices from Nisos investigators to safeguard your organization against employment fraud schemes. We are a digital and human risk investigations partner who operates as an extension of your security, trust, safety, legal, and intelligence teams. Uncover risks you can’t see, and proactively protect your organization by informing your legal, M&A, employment, and partner decisions. Protect your organization from insider threats with insights to reduce your risk and mitigate your losses. Our human risk insights protect your data and ensure workplace integrity. Protect your people and reduce their vulnerabilities and exposure. Pinpoint and avert the digital threats with the potential to evolve into physical harm. -
25
DigitalStakeout Scout
DigitalStakeout
DigitalStakeout Scout enables your cybersecurity and corporate security team to stand up an open-source intelligence capability on-demand. Solve brand threat intelligence, protective intelligence & executive protection, vulnerability and cyber threat intelligence, and digital risk protection challenges with a cloud-delivered security intelligence platform hosted and fully managed by DigitalStakeout. DigitalStakeout Scout provides the data collection capabilities and analytics technology required to spot and disrupt your organization’s threats, vulnerabilities, and exposures. Using a simple web-based UI, you’ll have an on-demand security intelligence tool that enables your analysts to filter out noise, reduce alert fatigue, accelerate investigations, and make smarter intelligence-led security decisions. DigitalStakeout Scout platform, analysts are 80% more productive, and customers, on average, cut the total cost of ownership of a security intelligence capability by 40%. -
26
AT&T Managed Threat Detection and Response protect your organization with 24x7 security monitoring from AT&T Cybersecurity powered by our award-winning USM platform and AT&T Alien Labs™ threat intelligence. 24x7 proactive security monitoring and investigation from the AT&T SOC. Our expert SOC analysts leverage our decades of managed security expertise to help you to protect your business by monitoring and disrupting advanced threats around the clock. Built on Unified Security Management (USM) with multiple security capabilities in one unified platform, we go beyond other MDR services to provide centralized security visibility across your cloud, networks, and endpoints, enabling early, effective detection and a rapid time to deployment. Powered by AT&T Alien Labs threat intelligence with unrivaled visibility of the AT&T IP backbone, global USM sensor network, and the Open Threat Exchange (OTX), AT&T Alien Labs delivers continuous, tactical threat intelligence to the USM platform.Starting Price: $6,695 per month
-
27
Secure Malware Analytics (formerly Threat Grid) combines advanced sandboxing with threat intelligence into one unified solution to protect organizations from malware. With a robust, context-rich malware knowledge base, you will understand what malware is doing, or attempting to do, how large a threat it poses, and how to defend against it. Secure Malware Analytics rapidly analyzes files and suspicious behavior across your environment. Your security teams get context-rich malware analytics and threat intelligence, so they’re armed with insight into what a file is doing and can quickly respond to threats. Secure Malware Analytics analyzes the behavior of a file against millions of samples and billions of malware artifacts. Secure Malware Analytics identifies key behavioral indicators of malware and their associated campaigns. Take advantage of Secure Malware Analytics's robust search capabilities, correlations, and detailed static and dynamic analyses.
-
28
Radware Threat Intelligence
Radware
Radware’s Threat Intelligence Subscriptions complement application and network security with constant updates of possible risks and vulnerabilities. By crowdsourcing, correlating and validating real-life attack data from multiple sources, Radware’s Threat Intelligence Subscriptions immunize your Attack Mitigation System. It provides real-time intelligence for preemptive protection and enables multi-layered protection against known and unknown vectors and actors as well as ongoing and emergency filters. Radware’s Live Threat Map presents near real-time information about cyberattacks as they occur, based on our global threat deception network and cloud systems event information. The systems transmit a variety of anonymized and sampled network and application attacks to our Threat Research Center and are shared with the community via this threat map. -
29
OpenText Enterprise Security Manager
OpenText
OpenText™ Enterprise Security Manager (ESM) is a robust Security Information and Event Management (SIEM) solution designed to provide comprehensive real-time threat detection and automated response. It features an industry-leading correlation engine that alerts analysts instantly to threat-correlated events, dramatically reducing the time required to detect and respond to cyber threats. ESM integrates native Security Orchestration, Automation, and Response (SOAR) capabilities, enabling organizations to streamline their security operations and lower total cost of ownership. With the ability to analyze over 100,000 events per second and support more than 450 event sources, it delivers enterprise-wide event visibility and enhanced threat intelligence. The platform’s scalable architecture supports customization through rulesets, dashboards, and reports tailored to unique security needs. It also offers multi-tenancy capabilities for centralized management across distributed business units. -
30
HivePro Uni5
HivePro
The Uni5 platform elevates traditional vulnerability management to holistic threat exposure management by identifying your enterprises' likely cyber threats, fortifying your weakest controls, and eliminating the vulnerabilities that matter most to reduce your enterprise risks. Minimizing your threat exposure and outmaneuvering cybercriminals requires enterprises to know their terrain, and the attacker’s perspective well. HiveUni5 platform provides wide asset visibility, actionable threat, and vulnerability intelligence, security controls testing, patch management, and in-platform, cross-functional collaboration. Close the loop on risk management with auto-generated strategic, operational, and tactical reports. HivePro Uni5 supports over 27 well-known asset management, ITSM, vulnerability scanners, and patch management tools out of the box, allowing organizations to utilize their existing investments. -
31
AT&T Alien Labs Open Threat Exchange
AT&T Cybersecurity
The world's largest open threat intelligence community that enables collaborative defense with actionable, community-powered threat data. Threat sharing in the security industry remains mainly ad-hoc and informal, filled with blind spots, frustration, and pitfalls. Our vision is for companies and government agencies to gather and share relevant, timely, and accurate information about new or ongoing cyberattacks and threats as quickly as possible to avoid major breaches (or minimize the damage from an attack). The Alien Labs Open Threat Exchange (OTX™) delivers the first truly open threat intelligence community that makes this vision a reality. OTX provides open access to a global community of threat researchers and security professionals. It now has more than 100,000 participants in 140 countries, who contribute over 19 million threat indicators daily. It delivers community-generated threat data, enables collaborative research, and automates the update of your security infrastructure. -
32
Trellix Helix Connect
Trellix
To protect against advanced threats, organizations need to integrate their security and apply the right expertise and processes. Trellix Helix Connect is a cloud-hosted security operations platform that allows organizations to take control of any incident from alert to fix. Gain comprehensive visibility and control across your entire enterprise by collecting, correlating and analyzing critical data for meaningful threat awareness. Easily integrate security functions without extensive and costly cycles. Make informed and efficient decisions with contextual threat intelligence. Detect advanced threats with machine learning, AI and integrated real-time cyber intelligence. Gain critical context into who is targeting your organization and why. With a smart and adaptive platform, you can predict and prevent emerging threats, identify root causes and respond in real time. -
33
ThreatConnect Threat Intelligence Platform
ThreatConnect
The ThreatConnect Threat Intelligence Platform (TIP) centralizes the aggregation and management of threat data. From one platform, users can normalize data from a variety of sources, add additional context, and automate manual threat intelligence-related security processes. ThreatConnect TIP provides a workbench to organize and prioritize threat data and use it to drive actions across a security team. -
34
Lumen Adaptive Threat Intelligence
Lumen Technologies
Adaptive Threat Intelligence helps security specialists quickly neutralize threats before they attack. Leveraging our global network visibility, we provide high-fidelity intelligence correlated to your IP addresses, combined with Rapid Threat Defense to proactively stop threats and simplify security. Automated validation technology developed and deployed by Black Lotus Labs tests newly discovered threats and validates the fidelity of our threat data, minimizing false positives. Rapid threat defense automated detection and response capabilities block threats based on your risk tolerance. Comprehensive virtual offering eliminates the need to deploy or integrate devices and data, and provides a single escalation point. Easy-to-use security portal, mobile app, API feed and customizable alerts that allow you to manage threat visualization and response with context-rich reports and historical views. -
35
ThreatSync
WatchGuard
From distributed enterprises with 10 branch offices to small and midsize businesses (SMBs) with employees working outside of the network, it can be a struggle to manage security consistently and cohesively across your organization. It is critical for SMBs and distributed enterprise organizations to not only have visibility into both their network and endpoint event data, but to be able to quickly and efficiently leverage actionable insight to remove threats. ThreatSync, a critical component of TDR, collects event data from the WatchGuard Firebox, Host Sensor and enterprise-grade threat intelligence feeds, analyzes this data using a proprietary algorithm, and assigns a comprehensive threat score and rank. This powerful correlation engine enables cloud-based threat prioritization to empower IT team to quickly and confidently respond to threats. Collects and correlates threat event data from the Firebox and Host Sensor. -
36
Microsoft Sentinel
Microsoft
Standing watch, by your side. Intelligent security analytics for your entire enterprise. See and stop threats before they cause harm, with SIEM reinvented for a modern world. Microsoft Sentinel is your birds-eye view across the enterprise. Put the cloud and large-scale intelligence from decades of Microsoft security experience to work. Make your threat detection and response smarter and faster with artificial intelligence (AI). Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs. Collect data at cloud scale—across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds. Detect previously uncovered threats and minimize false positives using analytics and unparalleled threat intelligence from Microsoft. Investigate threats with AI and hunt suspicious activities at scale, tapping into decades of cybersecurity work at Microsoft. -
37
Based on threat intelligence, big data mining and analysis, machine learning, visualization and other technologies, Wangsu situational awareness realizes the “visible, manageable, and controllable” network security situation, helping regulatory agencies, governments, enterprises and institutions improve discovery, identification, understanding, analysis, the ability to respond to potential threats, and help companies understand the operating status of online businesses in real time, and achieve a closed-loop business linkage of monitoring, early warning and emergency response. Supported by massive and continuous user access trajectory data, it effectively integrates and analyzes all threat intelligence, security incidents, etc., assesses the security of intrusion threats from a macro perspective, and helps companies effectively respond to unexpected new attacks. Real-time grasp of the latest security situation of the entire network and customer business.
-
38
LevelBlue Open Threat Exchange
LevelBlue
LevelBlue Open Threat Exchange (OTX) is a comprehensive security information and event management (SIEM) platform designed to provide real-time visibility and intelligence for network and security operations. OTX enables organizations to detect and respond to threats faster, offering capabilities such as asset discovery, vulnerability scanning, and log management. With an open architecture, OTX integrates with a wide range of security tools and data sources, providing a unified approach to threat detection and response. It's designed to enhance both operational efficiency and security posture, making it suitable for organizations of all sizes looking to streamline their security operations. -
39
ThreatWatch
ThreatWatch
Stay informed on emerging threats using real-time, machine curated threat intelligence. Detect and prioritize threats up to 3 months earlier than leading scanning solutions without redundant scanning or agents. Use Attenu8, our AI platform to prioritize your threats. Secure your DevOps pipeline against open source vulnerabilities, malware, code secrets and configuration issues. Secure your infrastructure, network and IOT devices and any other assets by modeling them as virtual assets. Discover and manage your assets easily with a simple open source CLI. Decentralize security functions using real-time alerts. Integrate with MSTeams, Slack, JIRA, ServiceNow and other ecosystems using our powerful API and SDK. Stay ahead of your adversaries. Get informed on emerging malware, vulnerabilities, exploits, patches and remediations in real-time using our AI powered, machine curated threat intelligence. -
40
CrowdStrike Falcon Adversary Intelligence
CrowdStrike
CrowdStrike Falcon® Adversary Intelligence provides cutting-edge threat intelligence to help organizations proactively identify and mitigate cyber threats. With access to over 250 adversary profiles, dark web monitoring, and real-time threat intelligence, businesses can strengthen their defense and accelerate response times. This platform integrates seamlessly into existing security operations, offering automated threat modeling, sandbox analysis, and the ability to automate security workflows. CrowdStrike Falcon® empowers organizations to stay ahead of emerging threats with comprehensive insights into adversary tactics, techniques, and procedures. -
41
ReversingLabs
ReversingLabs
ReversingLabs is a software supply chain security platform that helps organizations identify hidden threats within software components. It uses AI-driven binary analysis to detect malware, tampering, secrets, and other active threats that traditional tools often miss. ReversingLabs analyzes first-party, open-source, and third-party software to provide complete visibility into software risk. Its flagship solution, Spectra Assure®, identifies security issues in final builds before release. The platform leverages one of the world’s largest threat intelligence repositories to improve accuracy and reduce false positives. ReversingLabs helps organizations move from reactive threat detection to proactive risk management. It delivers trusted insights that strengthen software trust and security operations. -
42
Cortex XSOAR
Palo Alto Networks
Orchestrate. Automate. Innovate. The industry’s most comprehensive security orchestration, automation and response platform with native threat intelligence management and a built-in marketplace. Transform your security operations with scalable, automated processes for any security use case. Get up to a 95% reduction in the volume of alerts requiring human review. Cortex XSOAR ingests alerts across sources and executes automated workflows/playbooks to speed up incident response. Cortex XSOAR case management facilitates standardized response for high-quantity attacks while helping your teams adapt to sophisticated one-off attacks. Cortex XSOAR playbooks are complemented by real-time collaboration capabilities that let security teams rapidly iterate to solve emergent threats. Cortex XSOAR offers a new approach to threat intelligence management that unifies threat intelligence aggregation, scoring and sharing with proven playbook-driven automation. -
43
ThreatBook
ThreatBook
ThreatBook CTI provides high-fidelity intelligence collected from alerts from real customer cases. Our R&D team uses it as a critical indicator to evaluate our intelligence extraction and quality control work. Meanwhile, we continuously assess the data based on any relevant alerts from timely cyber incidents. ThreatBook CTI aggregates data and information with a clear verdict, behavior conclusions, and intruder portraits. It enables the SOC team to spend less time on irrelevant or harmless activities,boosting the operation's efficiency. The core value of threat intelligence is detection and response, that is, enterprises can carry out compromise detection with high-fidelity intelligence, figuring out if a device has been attacked or if a server has been infected and respond based on the investigation to prevent threats, isolate or avoid risks in a timely manner and reduce the likelihood of serious consequences. -
44
Spotlight Secure Threat Intelligence Platform
Juniper Networks
As the threat landscape continues to accelerate and evolve, the security industry continues to respond with a variety of disparate new detection technologies. Unfortunately, this approach results in customers struggling to manage a patchwork of uncoordinated security tools, leaving a gap between detection and enforcement at the firewall. Many next-generation firewalls (NGFWs) include integrated capabilities, such as intrusion prevention system (IPS), antivirus signatures, and proprietary reputation feeds, but they are closed systems that are not capable of taking full advantage of the highly diverse third-party and custom feeds utilized by customers, specific to their industry. Spotlight Secure Threat Intelligence Platform addresses these challenges and constraints by aggregating threat feeds from multiple sources to deliver open, consolidated, actionable intelligence to SRX Series Services Gateways across the organization. -
45
Intel 471 TITAN
Intel 471
Cybercriminals never sleep. You need round-the-clock threat intelligence to anticipate and track bad actors’ every move, and how they might attack your business. Our customers rely on TITAN, an intuitive intelligence SaaS platform built by intelligence and security professionals for intelligence and security professionals. It enables them to access structured information, dashboards, timely alerts, and intelligence reporting via the web portal or API integration. But TITAN doesn’t stop there. Use TITAN’s programmable RESTful API to power numerous connectors and integrations, integrating and operationalizing customized intelligence into your security operations. TITAN delivers structured technical and non-technical data and intelligence that is continually updated by our global team and automated processes. With structured data, less noise, and high-fidelity results, you can focus your team on the threats that matter most. -
46
Pulsedive
Pulsedive
Pulsedive offers threat intelligence platform and data products to help any security team streamline their threat intelligence research, processing, management, and integration. Start by searching any domain, IP, or URL at pulsedive.com. Our community platform provides free capabilities to enrich and investigate indicators of compromise (IOCs), analyze threats, query across the Pulsedive database, and submit new IOCs in bulk. What we do differently: - Perform passive or active scanning on every ingested IOC, on-demand - Risk evaluation and factors shared with our users based on first-hand observations - Pivot off any data property or value - Analyze shared threat infrastructure and properties for different threats Our commercial API and Feed products support the automation and integration of our data within organization security environments. Check out our website for different tiers and offerings. -
47
Rapid7 Threat Command
Rapid7
Rapid7 Threat Command is an advanced external threat intelligence tool that finds and mitigates threats directly targeting your organization, employees, and customers. By proactively monitoring thousands of sources across the clear, deep, and dark web, Threat Command enables you to make informed decisions and rapidly respond to protect your business. Quickly turn intelligence into action with faster detection and automated alert responses across your environment. This is made possible through plug-and-play integrations with your existing technologies for SIEM, SOAR, EDR, firewall, and more. Simplify your SecOps workflows through advanced investigation and mapping capabilities that provide highly contextualized alerts with low signal-to-noise ratio. Unlimited 24/7/365 access to our expert analysts shortens investigation times as well as accelerates alert triage and response. -
48
Transform security infrastructure into a collaborative system. Operationalize threat intelligence data in real time, delivering protection to all points in your enterprise as new threats emerge. Leverage Data Exchange Layer (DXL) to instantly share threat data to all connected security systems, including third-party solutions. Detect unknown files for faster time to protection and lower costs. Broader threat intelligence helps make accurate file execution decisions and customize policies based on risk tolerance. Enable better decision-making to handle never-before-seen and potentially malicious files. Combine and share threat information from Trellix Global Threat Intelligence, third parties, and locally collected data from your security solutions. DXL, an open communications framework, connects disparate security solutions. Share real-time security intelligence among endpoint, gateway, network, and data center security solutions.
-
49
scoutTHREAT
LookingGlass Cyber Solutions
Cybersecurity is continuously evolving—both threat actor methods and security practitioner defense. Continuously adjusting to these evolving Tactics, Techniques, and Procedures (TTPs) is a challenge to even the most advanced security operations. Collecting high-quality intelligence is not enough—security teams must be able to contextualize, process, and put into practice the intelligence it ingests in order to protect their organization. As the volume of intelligence increases, your organization needs a scalable cybersecurity threat management platform. Automation and higher workflow reduces the need for costly analysts and team members, without compromising the efficacy of your cybersecurity program. Conceived by Goldman Sachs, scoutTHREAT is a Threat Intelligence Platform (TIP) that enables your cybersecurity program to identify threats before impact. -
50
RST Cloud
RST Cloud
RST Threat Feed, RST Report Hub, RST Noise Control, RST IoC Lookup, RST Whois API are a subscription-based services delivered by RST Cloud. RST Cloud collects actual knowledge about threats from all the available public TI sources. Normalise, filter, enrich and score it and gives it to your SOC and SecOps team, or directly put to your security solutions in ready-to-use format. RST Cloud includes: - Intelligence data from more than 250 sources and more than 250 000 indicators each day, - AI-powered threat report library, - IOC data formatted in a unified and standardised format, - Filtered results to excluded high-volume false positives, - Enriched IOCs which become more helpful in investigations, - Scored IOCs based on their severity and actuality, - Enriching and filtering False Positives services for SecOps teams, - Out-of-the-box integration with various SIEM, SOAR, TIP, NGFW solutions.Starting Price: $50/month
