Best Threat Intelligence Platforms for Splunk Enterprise
View:
Compare the Top Threat Intelligence Platforms that integrate with Splunk Enterprise as of October 2025
Sort By:
This a list of Threat Intelligence platforms that integrate with Splunk Enterprise. Use the filters on the left to add additional filters for products that have integrations with Splunk Enterprise. View the products that work with Splunk Enterprise in the table below.
What are Threat Intelligence Platforms for Splunk Enterprise?
Threat intelligence platforms are tools that enable organizations to collect, analyze, and act on cybersecurity threat data to proactively defend against potential attacks. These platforms aggregate information from a variety of sources, including internal security systems, open-source intelligence, commercial threat feeds, and government alerts, to provide a comprehensive view of the threat landscape. By processing and correlating this data, threat intelligence platforms identify emerging threats, track attacker tactics, and provide actionable insights that can be used to strengthen defenses and inform decision-making. Many threat intelligence platforms also integrate with other security systems, such as Security Information and Event Management (SIEM) tools, to automate threat detection and response. Overall, these platforms enhance an organization’s ability to respond to and mitigate cyber threats quickly and effectively. Compare and read user reviews of the best Threat Intelligence platforms for Splunk Enterprise currently available using the table below. This list is updated regularly.
-
1
ThreatLocker
ThreatLocker
The ThreatLocker suite of security tools are powerful and designed so that everyone from businesses to government agencies to academic institutions can directly control exactly what applications run on their networks. We envision a future in which all organizations can chart their own course free from the influence of cybercriminals and the damage their incursions cause, and our team of veteran cybersecurity professionals created ThreatLocker to make this vision a reality. The team at ThreatLocker has been developing cybersecurity tools for decades, including programs to enhance email and content security, and this is our most innovative and ambitious cybersecurity solution yet. We developed this unique cybersecurity system because we believe that organizations should have complete control of their networks and should not have to live in fear of the next malware attack. To learn more, visit ThreatLocker.com. -
2
Reflectiz
Reflectiz
Reflectiz is a web exposure management platform that helps organizations identify, monitor, and mitigate security, privacy, and compliance risks across their online environments. It provides full visibility and control over first, third, and fourth-party components like scripts, trackers, and open-source libraries that traditional security tools often miss. Operating remotely without embedding code, Reflectiz ensures no impact on site performance, no access to sensitive user data, and no additional attack surface. The platform analyzes your digital supply chain, identifying risks in real-time and allowing for swift mitigation. Reflectiz offers a centralized dashboard for monitoring all public web assets, empowering teams with governance, risk management, and continuous monitoring. It helps businesses reduce attack surfaces, enhance security, and maintain compliance with evolving standards—without requiring code modifications.Starting Price: $5000/year -
3
DomainTools
DomainTools
Connect indicators from your network with nearly every active domain and IP address on the Internet. Learn how this data can inform risk assessments, help profile attackers, guide online fraud investigations, and map cyber activity to attacker infrastructure. Gain insight that is necessary to make the right decision about the risk level of threats to your organization. DomainTools Iris is a proprietary threat intelligence and investigation platform that combines enterprise-grade domain and DNS-based intelligence with an intuitive web interface. -
4
Silent Push
Silent Push
Silent Push reveals adversary infrastructure, campaigns, and security problems by searching across the most timely, accurate and complete Threat Intelligence dataset available. Defenders can focus on stopping threats before they cause a problem and significantly improve their security operations across the entire attack chain whilst simultaneously reducing operational complexity. The Silent Push platform exposes Indicators of Future Attack (IOFA) by applying unique behavioral fingerprints to attacker activity and searching our dataset. Security teams can identify new impending attacks, rather than relying upon out-of-date IOCs delivered by legacy threat intelligence. Our solutions include: Proactive Threat Hunting - Identify and track malicious infrastructure before it’s weaponized. Brand & Impersonation - Protect your brand from phishing, malvertisement, and spoofing attacks. IOFA Early Detection Feeds - Monitor global threat activity with proactive intelligence.Starting Price: $100/month -
5
threatYeti by alphaMountain
alphaMountain AI
threatYeti by alphaMountain, turns security professionals and hobbyists alike into a senior IP threat intelligence analysts with a browser-based platform that renders real-time threat verdicts for any domain, URL, or IP on the internet. With threatYeti, the risk posed by a domain is rendered instantly with a color-coded rating from 1.00 (low risk) to 10.00 (high risk). threatYeti also protects cyber threat analysts and their networks from risky sites. threatYeti’s no-click categorization presents sites into at least one out of 89 categories so that analysts don’t have to visit them and risk encountering objectionable material or downloading malware. threatYeti also displays related hosts, threat factors, passive DNS, certificates, redirect chains and more, giving analysts the full picture of any host. The result is faster, safer investigations that enable organizations to take conclusive action on domain and IP threats.Starting Price: $0 -
6
CyCognito
CyCognito
Expose all the hidden security gaps in your organization using nation-state grade technology. CyCognito’s Global Bot Network uses attacker-like reconnaissance techniques to scan, discover and fingerprint billions of digital assets all over the world. No input or configuration needed. Uncover the unknown. The Discovery Engine uses graph data modeling to map your organization’s full attack surface. You get a clear view of every single asset an attacker could reach — what they are and how they relate to your business. Using CyCognito’s proprietary risk-detection methods, the attack simulator identifies risks per asset and discovers potential attack vectors. It doesn’t affect business operations and works without deployment, configuration or whitelisting. CyCognito scores each risk based its attractiveness to attackers and impact on the business, dramatically reducing the thousands of attack vectors organizations may have to those critical few dozen that need your focusStarting Price: $11/asset/month -
7
SOC Prime Platform
SOC Prime
SOC Prime operates the world’s largest and most advanced platform for collective cyber defense that cultivates collaboration from a global cybersecurity community and curates the most up-to-date Sigma rules compatible with over 28 SIEM, EDR, and XDR platforms. SOC Prime’s innovation, backed by the vendor-agnostic and zero-trust cybersecurity approach, and cutting-edge technology leveraging Sigma language and MITRE ATT&CK® as core pillars are recognized by the independent research companies, credited by the leading SIEM, XDR & MDR vendors, and trusted by 8,000+ organizations from 155 countries, including 42% of Fortune 100, 21% of Forbes Global 2000, 90+ public sector institutions, and 300+ MSSP and MDR providers. Driven by its advanced cybersecurity solutions, Threat Detection Marketplace, Uncoder AI, and Attack Detective, SOC Prime enables organizations to risk-optimize their cybersecurity posture while improving the ROI of their SOC investments. -
8
Keepnet Labs
Keepnet Labs
Keepnet’s extended human risk management platform empowers organizations to build a security culture with AI-driven phishing simulations, adaptive training, and automated phishing response, helping you eliminate employee-driven threats, insider risks, and social engineering across your organization and beyond. Keepnet continuously assesses human behaviors through AI-driven phishing simulations across email, SMS, voice, QR codes, MFA, and callback phishing to reduce human-driven cyber risks. Keepnet's adaptive training paths are tailored to individual risk levels, roles, and cognitive behaviors, ensuring that secure behaviors are embedded to continuously reduce human cyber risk. Keepnet empowers employees to report threats instantly. Using AI-driven analysis and automated phishing responses, security admins respond 168x faster. Detects employees who frequently click phishing links, mishandle data, or ignore security policies.Starting Price: $1 -
9
Netwrix Threat Manager
Netwrix
Threat detection software from Netwrix to detect and respond to abnormal behavior and advanced attacks with high accuracy and speed. IT infrastructures are getting more complex and the volume of sensitive information stored there is skyrocketing. At the same time, the threat landscape is evolving rapidly, with attacks becoming more sophisticated and more costly. Improve your threat management processes and know about anything suspicious happening in your network, whether it’s an external attack or an insider threat, with real-time alerts delivered via email or mobile notifications. Maximize the value of your investments and enhance security across the IT ecosystem by sharing data between Netwrix Threat Manager and your SIEM and other security solutions. Respond immediately upon threat detection by taking advantage of the extensive catalog of preconfigured response actions, or by integrating Netwrix Threat Manager with your own business processes using PowerShell or webhook facilities. -
10
Kroll Cyber Risk
Kroll
We are the world incident response leader. Merging complete response capabilities with frontline threat intelligence from over 3000 incidents handled per year and end-to-end expertise we protect, detect and respond against cyberattacks. For immediate assistance, contact us today. Tackle every facet of today and tomorrow’s threat landscape with guidance from Kroll’s Cyber Risk experts. Enriched by frontline threat intel from 3000+ incidents cases every year, our end-to-end cyber risk solutions help organizations uncover exposures, validate the effectiveness of their defenses, implement new or updated controls, fine-tune detections and confidently respond to any threat. Get access to a wide portfolio of preparedness, resilience, detection and response services with a Kroll Cyber Risk retainer. Get in touch for more info. -
11
SecLytics Augur
SecLytics
Conventional TIPs alert you about threats when they are already knocking at your network door. SecLytics Augur uses machine learning to model the behavior of threat actors and create adversary profiles. Augur identifies the build-up of attack infrastructure and predicts attacks with high-accuracy and low false positives before they even launch. These predictions are fed to your SIEM or MSSP via our integrations to automate blocking. Augur builds and monitors a pool of more than 10k adversary profiles, with new profiles identified daily. Augur identifies threats before day zero and levels the playing field by removing the element of surprise. Augur discovers and protects against more potential threats than conventional TIPs. Augur detects the buildup of cybercriminal infrastructure online before attack launch. The behavior of infrastructure acquisition and setup is both systematic and characteristic. -
12
Proofpoint Identity Threat Defense
Proofpoint
In an ever-changing hybrid world, your organization depends on its employees, their virtual identities, and the endpoints they operate on to build and protect its assets. Threat actors have found unique ways to move laterally across your cloud environments by exploiting such identities. You need an innovative and agentless identity threat detection and response solution to discover and remediate modern identity vulnerabilities—a key part of today’s attack chain. Proofpoint Identity Threat Defense, previously Illusive, gives you comprehensive prevention and visibility across all your identities so you can remediate identity vulnerabilities before they become real risks. You can also detect any lateral movements in your environments and activate deception to ensure threat actors are stopped in action before they gain access to your corporate assets. It doesn’t get better than knowing you can prevent modern identity risks and stop real-time identity threats in action, all in one place. -
13
Leviathan Lotan
Leviathan Security Group
Lotan™ provides your enterprise with the unique capability to detect attacks earlier, and with greater confidence. The fragility of exploits in the face of modern countermeasures and environment heterogeneity often leads to application crashes. Lotan analyzes these crashes to detect the attack and aid the response. Lotan collects crashes using either a simple registry change on Windows, or a small userland application for Linux. A RESTful API allows you to share evidence and conclusions with your existing Threat Defense and SIEM solutions. The API provides insight into each step of Lotan's workflow, including detailed information required to understand and respond to the threat rapidly. Lotan greatly increases the accuracy, rate, and speed with which threats are detected, and impedes the ability of adversaries to operate undetected within your network. -
14
Learn what a digital risk protection solution is and how it can help you be better prepared by understanding who is targeting you, what they’re after, and how they plan to compromise you. Google Digital Risk Protection delivers a broad digital risk protection solution either via stand-alone self-managed SaaS products or a comprehensive service. Both options give security professionals visibility outside their organization, the ability to identify high-risk attack vectors, malicious orchestration from the deep and dark web, and attack campaigns on the open web. The Google Digital Risk Protection solution also provides contextual information on threat actors and their tactics, techniques, and procedures to provide a more secure cyber threat profile. Gain visibility into risk factors impacting the extended enterprise and supply chain by mapping your attack surface and monitoring deep and dark web activity.
-
15
Deep Instinct
Deep Instinct
Deep Instinct is the first and only company to apply end-to-end deep learning to cybersecurity. Unlike detection and response-based solutions, which wait for the attack before reacting, Deep Instinct’s solution works preemptively. By taking a preventative approach, files and vectors are automatically analyzed prior to execution, keeping customers protected in zero time. This is critical in a threat landscape, where real time is too late. With the aim of eradicating cyber threats from the enterprise, Deep Instinct protects against the most evasive known and unknown cyberattacks with unmatched accuracy, achieving highest detection rates and minimal false positives in tests regularly performed by third parties. Providing protection across endpoints, networks, servers, and mobile devices, the lightweight solution can be applied to most OSs and protects against both file-based and fileless attacks. -
16
Cyware
Cyware
Cyware is the only company building Virtual Cyber Fusion Centers enabling end-to-end threat intelligence automation, sharing, and unprecedented threat response for organizations globally. Cyware offers a full-stack of innovative cyber fusion solutions for all-source strategic, tactical, technical and operational threat intelligence sharing & threat response automation. Cyware’s Enterprise Solutions are designed to promote secure collaboration, inculcate cyber resilience, enhance threat visibility and deliver needed control by providing organizations with automated context-rich analysis of threats for proactive response without losing the element of human judgment. Cyware solutions are pushing the boundaries of current security paradigms by utilizing advances in Machine Learning, Artificial Intelligence, Security Automation & Orchestration technologies to empower enterprises in adapting to the evolving threat landscape. -
17
Darkfeed
Cybersixgill
Unleash cyber security performance, supercharge your security stack and maximize analysts’ performance with the ultimate underground threat intelligence collection available. Darkfeed is a feed of malicious indicators of compromise, including domains, URLs, hashes, and IP addresses. It relies on Cybersixgill’s vast collection of deep and dark web sources and provides unique and advanced warnings about new cyberthreats. It is automated, meaning that IOCs are extracted and delivered in real-time, and it is actionable, meaning that its consumers will be able to receive and block items that threaten their organizations. Darkfeed also offers the most comprehensive IOC enrichment solution on the market. By enriching IOCs from SIEM, SOAR, TIP or VM platforms, users gain unparalleled context and essential explanations in order to accelerate their incident prevention and response and stay ahead of the threat curve. -
18
ThreatConnect Threat Intelligence Platform
ThreatConnect
The ThreatConnect Threat Intelligence Platform (TIP) centralizes the aggregation and management of threat data. From one platform, users can normalize data from a variety of sources, add additional context, and automate manual threat intelligence-related security processes. ThreatConnect TIP provides a workbench to organize and prioritize threat data and use it to drive actions across a security team.
- Previous
- You're on page 1
- Next