PolySwarm Alternatives

ManageEngine EventLog Analyzer is an on-premise log management solution designed for businesses of all sizes across various industries such as information technology, health, retail, finance, education and more. The solution provides users with both agent based and agentless log collection, log parsing capabilities, a powerful log search engine and log archiving options. With network device auditing functionality, it enables users to monitor their end-user devices, firewalls, routers, switches and more in real time. The solution displays analyzed data in the form of graphs and intuitive reports. EventLog Analyzer's incident detection mechanisms such as event log correlation, threat intelligence, MITRE ATT&CK framework implementation, advanced threat analytics, and more, helps spot security threats as soon as they occur. The real-time alert system alerts users about suspicious activities, so they can prioritize high-risk security threats.

PathSolutions TotalView network monitoring and troubleshooting software bridges the gap between NETWORK MONITORING and TROUBLESHOOTING RESOLUTION telling you WHEN, WHERE and WHY network errors occur. PathSolutions TotalView continuously monitors and tracks the performance of every device and every link in your entire network, going deeper than other solutions by collecting error counters, performance data, configuration information and connectedness. A built-in heuristics engine analyzes all of this information to produce plain-English answers to problems. This means that complex problems can be solved by junior level engineers leaving the senior level engineers to work on more strategic level projects. The core product includes everything needed to run a perfectly healthy network: Configuration management, server monitoring, cloud service monitoring, IPAM, NetFlow, path mapping, and diagramming. Get Total Network Visibility on your network and solve more problems faster.

SIRP is a no-code risk-based SOAR platform that connects everything security teams need to ensure consistently strong outcomes into a single, intuitive platform. SIRP empowers Security Operations Centers (SOCs), Incident Response (IR) teams, Threat Intelligence teams, and Vulnerability Management (VM) teams through integration of security tools and powerful automation and orchestration tools. SIRP is a no-code SOAR platform with a built-in security scoring engine. The engine calculates real-world risk scores that are specific to your organization for every incident, alert, and vulnerability. This granular approach enables security teams to map risks to individual assets and prioritize response at scale. SIRP makes all security tools and functions available to security teams at the push of a button, saving thousands of hours each year. Design and enforce best practice security processes using SIRP’s intuitive drag-and-drop playbook building module.

Secure Malware Analytics (formerly Threat Grid) combines advanced sandboxing with threat intelligence into one unified solution to protect organizations from malware. With a robust, context-rich malware knowledge base, you will understand what malware is doing, or attempting to do, how large a threat it poses, and how to defend against it. Secure Malware Analytics rapidly analyzes files and suspicious behavior across your environment. Your security teams get context-rich malware analytics and threat intelligence, so they’re armed with insight into what a file is doing and can quickly respond to threats. Secure Malware Analytics analyzes the behavior of a file against millions of samples and billions of malware artifacts. Secure Malware Analytics identifies key behavioral indicators of malware and their associated campaigns. Take advantage of Secure Malware Analytics's robust search capabilities, correlations, and detailed static and dynamic analyses.

VIPRE ThreatAnalyzer is a dynamic malware analysis sandbox that lets you safely reveal the potential impact of malware on your organization, so you can respond faster and smarter in the event of a real threat. Today’s most devastating security risks are often disguised as legitimate executable files, PDFs, or Microsoft Office documents. One wrong click, and you can seriously disrupt business and rack up massive financial damage. But wouldn’t it be useful to see exactly how that might unfold? You could understand how an attack is constructed, and you could identify which networks and systems are at greatest risk. VIPRE ThreatAnalyzer allows you to intercept and reroute suspicious files, even ransomware and zero-day threats, to a sandbox where they can be detonated in a safe environment, and then analyzed by a machine-learning determination engine. You get the benefit of understanding how would-be attackers think, without compromising your networks.

WildFire® utilizes near real-time analysis to detect previously unseen, targeted malware and advanced persistent threats, keeping your organization protected. Access advanced file analysis capabilities to secure applications like web portals, integrate with SOAR tools, and more. Incorporate WildFire’s unique malware analysis capabilities spanning multiple threat vectors resulting in consistent security outcomes across your organization via an API. Choose flexible file submission and query volumes as needed without requiring a next-generation firewall. Leverage industry-leading advanced analysis and prevention engine capabilities, regional cloud deployments, & unique network effect. WildFire combines machine learning, dynamic and static analysis, and a custom-built analysis environment to discover even the most sophisticated threats across multiple stages and attack vectors.

Threat actors today are highly sophisticated and are using disruptive technologies to penetrate the security walls of enterprises in unrelenting fashion. Reverss provides automated dynamic malware analysis to enable Cyber Intelligence Response Teams (CIRT) to mitigate obfuscated malware faster and effectively. Speedy detection of malware is powered by a central detection engine to drive functions around security operations towards correct threat response. Get actionable insights on how to tackle and rapidly nullify attacks with backing from robust security libraries that track past threats and intelligently reverse new ones. Enrich tasks of security analysts to expose more threat behaviors with context to understand the scope of threat. Derive thorough Malware Analysis Reports that drill down every detail of why, how and when an evasion occurred to upkeep your experts with knowledge and defend your business from future attacks.

Jotti's malware scan is a free service that lets you scan suspicious files with several anti-virus programs. You can submit up to 5 files at the same time. There is a 250MB limit per file. Please be aware that no security solution offers 100% protection, not even when it uses several anti-virus engines. All files are shared with anti-virus companies so detection accuracy of their anti-virus products can be improved. We are not interested in names, addresses, or other information providing insight into the identities of our visitors, but we do log and use some of the data you provide. We recognize that privacy is important and we want you to completely understand what happens with the information you send to us. We store files you send in for scanning and share these with anti-malware companies. We do this to help anti-malware companies improve the detection accuracy of their security products. We treat your files confidentially.

A complete advanced malware analysis platform that speeds destructive file detection through automated static analysis. Delivered in any cloud, any environment, for every part of the enterprise. Over 360 file formats processed and 3600 file types identified from diverse platforms, applications & malware families. Real-time, deep inspection of files, scalable to 150 million files per day without dynamic execution. Tightly coupled connectors integrate industry leading email, EDR, SIEM, SOAR, and analytics platforms. Unique Automated Static Analysis fully dissects internal contents of files in 5 ms without execution, obviating the need for dynamic analysis in most cases. Empower dev and AppSec teams with the industry-leading SBOM that delivers a full and accurate software picture through dependency, malicious behavior and tampering visibility, that accelerates confident release and compliance, while giving the SOC deep software threat intelligence to isolate and respond.

Get zero-day threat detection. Analyze events for immediate threat and risk detection to determine if your organization was exposed to a specific attack. Correlate all logs, events, and network flows together—along with contextual information such as identity, roles, vulnerabilities, and more—to detect patterns indicative of a larger threat. In rule-less correlation systems, detection signatures are replaced with a simple, one-time configuration, providing real-time threat detection. Receive notifications if specific users, groups, applications, servers, or subnets are threatened. Get the processing power required to support rich event correlation across your entire enterprise. Streamline event correlation and startup. Trellix Advanced Correlation Engine does not require rule updates or signature tuning. Use audit trails and historical replays to support forensics, compliance, and rule tuning. Keep a complete audit trail of risk scores to analyze threat conditions over time.

Accelerate investigations and improve analyst productivity with a XDR Cybersecurity Solution. The Respond Analyst™, an XDR Engine, automates the discovery of security incidents by turning resource-intensive monitoring and initial analysis into thorough and consistent investigations. Unlike other XDR solutions, the Respond Analyst connects disparate evidence using probabilistic mathematics and integrated reasoning to determine the likelihood that events are malicious and actionable. The Respond Analyst augments security operations teams by significantly reducing the need to chase false positives resulting in more time for threat hunting. The Respond Analyst allows you to choose best-of-breed controls to modernize your sensor grid. The Respond Analyst integrates with the leading security vendor offerings across important categories such as EDR, IPS, Web Filtering, EPP, Vulnerability Scanning, Authentication, and more.

The leading AI-powered Digital Risk Monitoring platform that detects 3rd party data leaks instantly. XVigil first gathers millions of data units from online sources. This raw data is filtered for noise, false positives, and anomalies, using a powerful AI engine. After which it is indexed, parsed, checked against the historical data lake, and mapped to clients’ assets. Duplicates and familiar threats are discarded, and the remaining relevant threats are rated based on severity, and sent to customers as alerts. Monitors your internet exposed infrastructure, curates a list of all asset-inventory and then periodically monitors misconfigurations, and potential data leakages. XVigil spans the internet to actively detect external threats as regards your organization, classify them based on their severity, and provide real-time alerts. Backed by 5 years of extensive research and development, CloudSEK’s ‘XVigil’ is a SaaS-based easy-to-use platform.

Intezer automates Tier 1 SOC tasks, working like an extension of your team. Intezer can monitor incoming incidents from endpoint, email, or SIEM tools, then "autonomously" collects evidence, investigates, triages, triggers remediation action, and escalates only the the serious threats to your team for human intervention. Fast set up and integrations with your SOC and IR teams workflows (EDR, SOAR, SIEM, etc.) means you can starting filtering out false positives, get detailed analysis about every threat, and speed up your incident response time. Make sure every incident and artifact (such as files, URLs, endpoint memory, etc.) gets deeply analyzed, detecting malicious code in memory and other evasive threats.

You can throw any suspicious file at it and in a matter of minutes Cuckoo will provide a detailed report outlining the behavior of the file when executed inside a realistic but isolated environment. Malware is the swiss-army knife of cybercriminals and any other adversary to your corporation or organization. In these evolving times, detecting and removing malware artifacts is not enough: it's vitally important to understand how they operate in order to understand the context, the motivations, and the goals of a breach. Cuckoo Sandbox is free software that automated the task of analyzing any malicious file under Windows, macOS, Linux, and Android. Cuckoo Sandbox is an advanced, extremely modular, and 100% open source automated malware analysis system with infinite application opportunities. Analyze many different malicious files (executables, office documents, pdf files, emails, etc) as well as malicious websites under Windows, Linux, macOS, and Android virtualized environments.

YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strings and a boolean expression which determine its logic. YARA-CI may be a useful addition to your toolbelt. This is GitHub application that provides continuous testing for your rules, helping you to identify common mistakes and false positives. The above rule is telling YARA that any file containing one of the three strings must be reported as silent_banker.

Binary Ninja is an interactive disassembler, decompiler, and binary analysis platform for reverse engineers, malware analysts, vulnerability researchers, and software developers that runs on Windows, macOS, and Linux. Disassemble executables and libraries from multiple formats, platforms, and architectures. Decompile code to C or BNIL for any supported architecture, including your own. Automate analysis with C++, Python, and Rust APIs from inside or outside the UI. Visualize control flow and navigate through cross-references interactively. Name variables and functions, apply types, create structures, and add comments. Collaborate effortlessly with synchronized commits using our Enterprise product. Our built-in decompiler works with all of our officially supported architectures at one price and builds on a powerful family of ILs called BNIL. In fact, not just our architectures, but even community architectures can produce amazing decompilation.

It is difficult to apply the latest security patch to various fixed function systems, such as Industrial Control Systems (ICS), Point of Sales (POS) Systems, KIOSKs, and ATMs, due to their sensitivity and outdated OS. This leaves them vulnerable to malware infection. As such these systems are placed in air-gapped network or low bandwidth network environments, which are designed to perform only set processes with bare minimum system requirements, it is often impossible to perform engine updates, real-time detection, and remediation with security programs built for PC environment. AhnLab Xcanner enables users to set scan and repair options according to each operating environment and provides minimal clashes with pre-installed security agents. Due to its user-friendly interface, on-site workers and facility managers with zero security knowledge can also easily respond to malware.

Deep Discovery Inspector is available as a physical or virtual network appliance. It’s designed to quickly detect advanced malware that typically bypasses traditional security defenses and exfiltrates sensitive data. Specialized detection engines and custom sandbox analysis detect and prevent breaches. Organizations are increasingly becoming victims of targeted ransomware when advanced malware bypasses traditional security, encrypts data, and demands payment to release the data. Deep Discovery Inspector uses known and unknown patterns and reputation analysis to detect the latest ransomware attacks, including WannaCry. The customized sandbox detects mass file modifications, encryption behavior, and modifications to backup and restore processes. Security professionals are flooded with threat data coming from numerous sources. Trend Micro™ XDR for Networks helps prioritize threats and provide visibility into an attack.

PT MultiScanner provides multiple levels of anti-malware protection to detect and block infections on corporate infrastructure, uncover hidden threats, and facilitate investigation of malware-related security incidents. Counting on the same antivirus vendor to be right every time? Draw on the best anti-malware vendors and Positive Technologies expertise instead. Extensive integration support and scalability make PT MultiScanner the right choice for both startups and the largest corporations. Suspicious objects are scanned with multiple anti-malware engines, static analysis, and Positive Technologies reputation lists. The solution supports scanning of files and archives, including recursively compressed ones. As a result, PT MultiScanner can spot and block malware far more effectively than any one method used in isolation.

REMnux® is a Linux toolkit for reverse-engineering and analyzing malicious software. REMnux provides a curated collection of free tools created by the community. Analysts can use it to investigate malware without having to find, install, and configure the tools. The easiest way to get the REMnux distro is to download the REMnux virtual machine in the OVA format, then import it into your hypervisor. You can also install the distro from scratch on a dedicated host or add it to an existing system running a compatible version of Ubuntu. The REMnux toolkit also offers Docker images of popular malware analysis tools, making it possible to run the them as containers without having to install the tools directly on the system. You can even run the REMnux distro as a container. For details about installing, using, and contributing to REMnux, as well as for information about the tools included in the toolkit, see the REMnux documentation site.

QFlow is an advance malware detection and analysis platform to reduce the risk of infection during file transfers. QFlow offers comprehensive detection methods and the customization and automation of processing chains to meet specific needs. QFlow integrates a suite of tools that allow advanced analysis of potentially malicious files: commercial antiviruses, commercial sandboxes, open source tools optimized with Quarkslab's expertise. The deployment modes offered, as well as the strict security requirements that apply to the solution, reduce the risk of data leakage. Use Cases: - detection of malware in files and URLs - advanced threat analysis for security engineers - simplified integration into IT infrastructure or business application chains via ICAP or APIs - removable device security through white stations Analysis: - Static analysis (4 AVs) - Dynamic analysis (VMRay) - Morphological analysis (Binary analysis by Cyber Detect's GORILLE)

Here you can find common 'how-to' and troubleshooting guides around this community platform and aspects of the Falcon Sandbox platform. Please use the menu on the left side to navigate through some of the published articles. Hybrid Analysis requires that users undergo the Hybrid Analysis Vetting Process prior to obtaining an API key or downloading malware samples. Please note that you must abide by the Hybrid Analysis Terms and Conditions and only use these samples for research purposes. You are not permitted to share your user credentials or API key with anyone else. Please notify Hybrid Analysis immediately if you believe that your API key or user credentials have been compromised. At times, it may happen that a vetting request will get rejected due to incomplete data or a missing full real name, real business name or other means of validating cybersecurity credentials. In this case, it is possible to re-submit a vetting request one more time.

The Avira Cloud Sandbox is an award-winning, unlimited-scale automated malware analysis service. It blends multiple advanced analysis technologies to deliver a complete threat intelligence report from an uploaded file. The Cloud Sandbox API delivers a detailed, file-specific, threat intelligence report. It contains valuable, actionable intelligence. The report has a detailed classification of the file, information on the techniques, tactics and procedures (IoCs) present in the threat, and a description of how and why the submitted file was identified as clean, malicious, or suspicious. Avira’s Cloud Sandbox leverages the technologies developed within the Avira Protection Cloud, the cloud security system that underpins the anti-malware and threat intelligence solutions of Avira. Through OEM technology partnerships we protect many of the world’s leading cyber-security vendors, and nearly a billion people world-wide.

Because Valkyrie analyzes the entire run-time behavior of a file, it is more effective at detecting zero-day threats missed by the signature-based detection systems of classic antivirus products. The Valkyrie console allows users to upload new files for analysis and to view scan results in a range of dashboards and reports. Users can also forward files to Comodo Labs for in-depth, human expert checks. The Comodo Unknown File Hunter tool allows users to locally scan entire networks for unknown files then upload them to Valkyrie for analysis. Valkyrie analysis systems consist of multiple techniques to ensure each and every file submitted is analyzed thoroughly before providing the verdict. In order to do that Valkyrie deploys two types of technologies - Automatic analysis and Human Expert analysis.

VirusTotal inspects items with over 70 antivirus scanners and URL/domain blocklisting services, in addition to a myriad of tools to extract signals from the studied content. Any user can select a file from their computer using their browser and send it to VirusTotal. VirusTotal offers a number of file submission methods, including the primary public web interface, desktop uploaders, browser extensions and a programmatic API. The web interface has the highest scanning priority among the publicly available submission methods. Submissions may be scripted in any programming language using the HTTP-based public API. VirusTotal can be useful in detecting malicious content and also in identifying false positives, normal and harmless items detected as malicious by one or more scanners. As with files, URLs can be submitted via several different means including the VirusTotal webpage, browser extensions and the API.

Immunity Debugger's interfaces include the GUI and a command line. The command line is always available at the bottom of the GUI. It allows the user to type shortcuts as if they were in a typical text-based debugger, such as WinDBG or GDB. Immunity has implemented aliases to ensure that your WinDBG users do not have to be retrained and will get the full productivity boost that comes from the best debugger interface on the market. Python commands can also be run directly from our command bar. Users can go back to previously entered commands, or just click in the dropdown menu and see all the recently used commands. Immunity Debugger's interfaces include the GUI and a command line. The command line is always available at the bottom of the GUI. It allows the user to type shortcuts as if they were in a typical text-based debugger, such as WinDBG or GDB.

Radware’s Threat Intelligence Subscriptions complement application and network security with constant updates of possible risks and vulnerabilities. By crowdsourcing, correlating and validating real-life attack data from multiple sources, Radware’s Threat Intelligence Subscriptions immunize your Attack Mitigation System. It provides real-time intelligence for preemptive protection and enables multi-layered protection against known and unknown vectors and actors as well as ongoing and emergency filters. Radware’s Live Threat Map presents near real-time information about cyberattacks as they occur, based on our global threat deception network and cloud systems event information. The systems transmit a variety of anonymized and sampled network and application attacks to our Threat Research Center and are shared with the community via this threat map.

Criminal IP is a comprehensive threat intelligence search engine that detects vulnerabilities of personal and corporate cyber assets in real time and facilitates preemptive responses accordingly. Originated from the idea that individuals and corporations would be able to strengthen their cyber security by proactively acquiring information about IP addresses attempting to access your network, Criminal IP uses its big data of more than 4.2 billion IP addresses to provide threat-relevant information on malicious IPs and links, phishing sites, certificates, industrial control systems, IoTs, servers, security cameras, and so forth. With Criminal IP’s 4 main features (Asset Search, Domain Search, Exploit Search, and Image Search), you can find IP risk scores and related vulnerabilities of searched IP addresses and domains, details on the exploit codes for each service, and assets that are left wide open to cyber threats in the form of images respectively.

From distributed enterprises with 10 branch offices to small and midsize businesses (SMBs) with employees working outside of the network, it can be a struggle to manage security consistently and cohesively across your organization. It is critical for SMBs and distributed enterprise organizations to not only have visibility into both their network and endpoint event data, but to be able to quickly and efficiently leverage actionable insight to remove threats. ThreatSync, a critical component of TDR, collects event data from the WatchGuard Firebox, Host Sensor and enterprise-grade threat intelligence feeds, analyzes this data using a proprietary algorithm, and assigns a comprehensive threat score and rank. This powerful correlation engine enables cloud-based threat prioritization to empower IT team to quickly and confidently respond to threats. Collects and correlates threat event data from the Firebox and Host Sensor.

Expose all the hidden security gaps in your organization using nation-state grade technology. CyCognito’s Global Bot Network uses attacker-like reconnaissance techniques to scan, discover and fingerprint billions of digital assets all over the world. No input or configuration needed. Uncover the unknown. The Discovery Engine uses graph data modeling to map your organization’s full attack surface. You get a clear view of every single asset an attacker could reach — what they are and how they relate to your business. Using CyCognito’s proprietary risk-detection methods, the attack simulator identifies risks per asset and discovers potential attack vectors. It doesn’t affect business operations and works without deployment, configuration or whitelisting. CyCognito scores each risk based its attractiveness to attackers and impact on the business, dramatically reducing the thousands of attack vectors organizations may have to those critical few dozen that need your focus

Cysiv’s next-gen, co-managed SIEM addresses the limitations and frustrations associated with traditional SIEMs and other products used in a SOC. Our cloud-native platform automates and improves critical processes for truly effective threat detection, hunting, investigation and response. Cysiv Command combines essential technologies for a modern SOC into a comprehensive, unified, cloud-native platform and is the foundation for SOC-as-a-Service. Most telemetry can be pulled from APIs or sent securely to Cysiv Command over the internet. For older sources, such as logs over Syslog UDP, Cysiv Connector provides an encrypted conduit for passing all required telemetry from your environment to the Cysiv platform. Cysiv’s threat detection engine applies a blend of detection techniques that leverage signatures, threat intelligence, user behavior, statistics, and machine learning to automatically identify potential threats and ensures analysts focus on the most critical detections first.

Third parties, customers, and partners present legal, reputational, and compliance risks to your organization. The Kroll Compliance Portal arms you with the capabilities to control those risks at scale. Relative risk can dictate the need for a closer look. Emailing back and forth with analysts and downloading and saving files can slow you down, create a gap in the audit trail, and leave you vulnerable to information security risks. Take the due diligence process out of emails and file folders and bring order with the Kroll Compliance Portal. Many compliance programs become time and resource intensive because of manual processes or inflexible software. Put an end to that with the Kroll Compliance Portal’s Workflow Automation. Your business demands efficient third party onboarding. You need an accurate risk assessment. The Kroll Compliance Portal Questionnaire accelerates the onboarding process through automation, tracking and scoring in line with your risk model.

Unlike other security companies, we offer real-time intel that organizations can use to manipulate adversarial behavior even before being attacked. We built a distributed threat deception platform that allows you to take a step forward in defense. Take back control. We have built the highest-quality deception platform for active defense. Our proprietary ActiveLures™ populate ActiveSense™ environments and communicate using our ActiveLink™ technology.

Polis is a community-driven, smart chain, focused on creating technology to start accepting cryptocurrencies easily and securely. Polis is a cryptocurrency from the community and for the communities. Stake, swap, trade, and engage with a vibrant society building the future of payments. Polis stakers help secure the network by supporting chain validators. These validators receive the rewards at the end of each epoch and share the rewards proportionally to all of the stakers that supported them. There are many exchanges that sell and buy Polis. Compare the options and find the one that suits you best. Over the last four years, our governance has evolved to allow the Polis Project to be more efficient, transparent, and accessible for our community, from which great initiatives have been carried out.

Join us in our mission to democratize offensive security with tailored best-in-class solutions that address the unique needs of professionals and organizations. Evolve from the terminal to a specialized IDE for offensive security. Use Trickest’s library of tool nodes, import your own scripts, or drop in your favorite open-source tools all in one place. Choose from template workflows for common tasks and a growing list of 300+ open source tools the security community loves. Run your workflows in the cloud with easy autoscaling and cost controls. Skip manual infrastructure setup and stop paying for idle VPSs. No more digging through filesystems for your old runs, use Trickest’s spaces, projects, and workflow versioning to stay on top of even the most complex projects. Trickest is for anyone who interacts with offensive security: enterprise security teams, red teams, purple teams, specialized pen testers, bug bounty hunters, security researchers, educators, etc.

Drive better detections with high quality, actionable, out-of-the-box threat detection content curated, built, and maintained by Google Cloud Threat Intelligence researchers. Native detection sets cover a variety of threats across vectors, including Windows-based attacks like ransomware, remote-access tools (RAT), infostealers, data exfiltration, and suspicious activity. Unlock new detection coverage with new analytics regularly built by Google Cloud Threat Intelligence researchers uncovering new and latent attacks. Use GCTI detections to build response actions and write rules customized to your environment. Leverage the VirusTotal Augment widget to drive efficiencies in SOC processes, and enable faster search for artifacts like domains, IPs, URLs or hashes. Gain context beyond your network perimeter, expand your telemetry and explore related VirusTotal IoCs in a graphical manner.

RiskIQ PassiveTotal aggregates data from the whole internet, absorbing intelligence to identify threats and attacker infrastructure, and leverages machine learning to scale threat hunting and response. With PassiveTotal, you get context on who is attacking you, their tools and systems, and indicators of compromise outside the firewall—enterprise and third party. Investigation can go fast, really fast. Find answers quickly with over 4,000 OSINT articles and artifacts. Along with 10+ years of mapping the internet, RiskIQ has the deepest and broadest security intelligence on earth. By absorbing web data like Passive DNS, WHOIS, SSL, hosts and host pairs, cookies, exposed services, ports, components, and code. With curated OSINT and proprietary security intelligence, you can see everything—from every angle—on the digital attack surface. Take charge of your digital presence and combat threats to your organization.

Cyren Inbox Security is an innovative solution that turns the tables on the phishers and safeguards each and every Office 365 mailbox in your organization against evasive phishing, business email compromise (BEC) and fraud. Continuous monitoring and detection provide early exposure of evasive attack indicators and anomalies. Automated response and remediation for individual mailboxes and across all mailboxes in the organization will take care of the heavy lifting. Our unique crowd-sourced user detection closes the feedback loop on alerts, reinforcing your security training and providing valuable threat intelligence. Comprehensive, multi-dimensional presentation of critical threat characteristics to help analysts understand the evolving threat landscape. Improved threat detection for existing security products such as SIEM and SOAR solutions.

Tomorrow's operations depend on unrivaled threat intelligence, today. Power up investigation, prevention and response with AutoFocus. Palo Alto Networks, provider of the industry-leading next-generation firewall, has made the world’s highest-fidelity repository of threat intelligence, sourced from the largest network of sensors, available for any team or tool to consume. AutoFocus™ contextual threat intelligence service is your one-stop shop for threat intelligence. Your teams will receive instant understanding of every event with unrivaled context from Unit 42 threat researchers, and you can embed rich threat intelligence in analyst’s existing tools to significantly speed investigation, prevention, and response. Get unique visibility into attacks crowdsourced from the industry’s largest footprint of network, endpoint, and cloud intel sources. Enrich every threat with the deepest context from worldrenowned Unit 42 threat researchers.

As our base of Sentinel IPS units has grown, we’ve come to realize the attack data we gather has significant value, both to our own customers and to the community at large. Collective Intelligence Network Security (CINS, pronounced “sins,” get it?) is our effort to use this information to significantly improve the security of our customers’ networks. We also provide this vital information to the InfoSec community free of charge. Our CINS system is constantly gathering attack data from each of our Sentinel units in the field. Using this data, we calculate a CINS Score for every IP address flagged by our system. Much like a FICO score, which shows you the quality of your credit, the CINS Score is designed to show you the quality – the trustworthiness – of an IP address. The IP address’ whois information, country of origin, the nature, frequency and breadth of its attacks across the Sentinel network are listed with the CINS Score.

FOFA is a Search Engine for global cyberspace mapping. Through continuous active detection of global Internet assets, identifying most software and hardware network assets. Asset data supports external presentation and application in various ways and can perform hierarchical portraits of assets based on IP.

CrowdSec is a free, open-source and collaborative IPS to analyze behaviors, respond to attacks & share signals across the community, outnumbering cybercriminals all together. Set up your own intrusion detection system. Apply behavior scenarios to identify cyber threats. Share and benefit from a crowdsourced and curated cyber threat intelligence system. Define the type of remediation you want to apply and where. Leverage the community’s IP blocklist and automate your security. CrowdSec is designed to run seamlessly on virtual machines, bare-metal servers, containers or to be called directly from your code with our API. Our strength comes from our cybersecurity community that is burning cybercriminals’ anonymity. By sharing IP addresses that aggressed you, you help us curate and redistribute a qualified IP blocklist to protect everyone. CrowdSec is 60x faster than tools like Fail2ban and can parse massive amounts of logs in no time.

Resecurity Risk is dedicated threat monitoring platform for brands, their subsidiaries, assets, and executives. Launch in 24 hours just import your unique digital identifiers and get close to real-time updates of over 1 Petabyte of actionable intelligence impacting you now. Security information and event management (SIEM) tools can help identify and highlight many critical events at a glance if all active threat vectors are available to be ingested within the platform and are from verified sources with accurate risk scoring. Resecurity Risk an omni-directional threat product which would usually require multiple vendors to resolve. Integrate available security solutions to actualize the risk score of your enterprise footprint. Driven by your data, powered by Context™. Holistic approach to piracy and counterfeit monitoring for various industry verticals. Prevent illicit distribution and use of your products, using actionable intelligence.

3 out of 4 companies are subject to computer attacks or hacking. However, 90% are equipped with essential security equipment that does not detect these malicious attacks. APTs, malicious behaviors, viruses, crypto lockers, override existing security defenses and no current tool can detect these attacks. Yet these attacks leave footprints of their passage. Finding these malicious traces on a large amount of data and exploiting these signals is impossible with current tools. Reveelium correlates and aggregates all types of logs from an information system and detects attacks or malicious activity in progress. An essential tool in the fight against cyber-malware Reveelium SIEM can be used alone or complemented by Ikare, Reveelium UEBA or ITrust’s Acsia EDR, to provide a true next-generation security center (SOC). Have the practices of its teams monitored by a third party and obtain an objective opinion on its level of safety.

Securing your network against advanced persistent threats (APTs) requires greater visibility to detect and reduce your response time. As threats increase, cloud-based Network Detection and Response (NDR) solutions are more important than ever. MistNet NDR by LogRhythm provides a machine learning (ML)-driven network threat detection and response solution and a built-in MITRE ATT&CK™ Engine that eliminates blind spots and monitors your organization’s network in real time. Download this guide and learn how you can use the MITRE ATT&CK Engine in MistNet NDR by LogRhythm to hunt for threats, run compliance checks, and measure the efficiency of your SOC.

We live in a digital world, but the current economics of storing and processing enterprise security data have made it not just expensive, but nearly impossible to compete against cybercrime. But what if the scalability and economics of storing and analyzing your organization's security data were no longer an issue? Chronicle was built on the world’s biggest data platform to bring unmatched capabilities and resources to give good the advantage. Sourced by Chronicle’s security research team, Google Cloud threat signals are embedded right in the Chronicle platform. Uppercase signals are based on a mix of proprietary data sources, public intelligence feeds, and other information. Even the best analysts struggle to process the sheer volume of security telemetry that a modern enterprise generates. Chronicle can handle petabytes of data, automatically. Automatic analysis helps your analysts understand suspicious activity in seconds, not hours.

RST Threat Feed, RST Report Hub, RST Noise Control, RST IoC Lookup, RST Whois API are a subscription-based services delivered by RST Cloud. RST Cloud collects actual knowledge about threats from all the available public TI sources. Normalise, filter, enrich and score it and gives it to your SOC and SecOps team, or directly put to your security solutions in ready-to-use format. RST Cloud includes: - Intelligence data from more than 250 sources and more than 250 000 indicators each day, - AI-powered threat report library, - IOC data formatted in a unified and standardised format, - Filtered results to excluded high-volume false positives, - Enriched IOCs which become more helpful in investigations, - Scored IOCs based on their severity and actuality, - Enriching and filtering False Positives services for SecOps teams, - Out-of-the-box integration with various SIEM, SOAR, TIP, NGFW solutions.

SecureDoc is an encryption and security management solution designed to safeguard data at rest (DAR). The software has two components: client software for encrypting and decrypting data and server software for configuration and management across the organization's laptops, desktops, servers and external devices. Using a FIPS 140-2 validated AES 256-bit cryptographic engine, SecureDoc ensures compliance with industry regulations and data integrity. With features like pre-boot authentication and central management, the software seamlessly protects sensitive information on various platforms (Windows, macOS and Linux).

Real-time threat intelligence derived from hundreds of millions of sensors worldwide, enriched with AI-based engines and exclusive research data from the Check Point Research Team. Detects 2,000 attacks daily by unknown threats previously undiscovered. Advanced predictive intelligence engines, data from hundreds of millions of sensors, and cutting-edge research from Check Point Research and external intelligence feed. Up-to-minute information on the newest attack vectors and hacking techniques. ThreatCloud is Check Point’s rich cyber defense database. Its threat intelligence powers Check Point zero-day protection solutions. Mitigate threats 24×7 with award-winning technology, expert analysis and global threat intelligence. In addition, the service provides recommendations for tuning the customer’s threat prevention policies to enhance the customer’s protection against threats. Customers have access to a Managed Security Services Web Portal.

Orchestrate. Automate. Innovate. The industry’s most comprehensive security orchestration, automation and response platform with native threat intelligence management and a built-in marketplace. Transform your security operations with scalable, automated processes for any security use case. Get up to a 95% reduction in the volume of alerts requiring human review. Cortex XSOAR ingests alerts across sources and executes automated workflows/playbooks to speed up incident response. Cortex XSOAR case management facilitates standardized response for high-quantity attacks while helping your teams adapt to sophisticated one-off attacks. Cortex XSOAR playbooks are complemented by real-time collaboration capabilities that let security teams rapidly iterate to solve emergent threats. Cortex XSOAR offers a new approach to threat intelligence management that unifies threat intelligence aggregation, scoring and sharing with proven playbook-driven automation.