Forty five million indicators,
checked on every event.
Threat intelligence that lives in a separate tab is decoration. Matching runs in line as part of the pipeline, against every decoded event, on a dedicated path so a match can never be suppressed by a rule that happened to match more deeply.
Indicators by type and feed, with matches against live traffic.
Forty five million lookups per event, and the CPU does not notice.
A naive indicator list at this size would be a rule that evaluates forty five million comparisons. Indicators are held in per type bloom filters, so the common case, an event that matches nothing, is answered in constant time with a small memory footprint.
- ▸Per type filters. Address, domain, URL and hash each get their own structure, so a lookup never scans the wrong set.
- ▸Streamed, not loaded. The full corpus streams into a compact in memory structure rather than a heap sized copy.
- ▸Rebuilt on a schedule so a new indicator is live within hours, without a restart.
- ▸It costs a few percent. The whole matcher runs alongside decoding and rules on the same worker.
Every feed with its indicator count, last run and any error. No silent failures.
On its own path, so nothing can hide it.
The rule cascade is deepest match wins, which means an ungated threat intel rule would be suppressed by whichever decoder rule the event also matched. So indicator matching runs as its own stage, reading the same decoded events, and emits its own finding.
- ▸Candidates from real fields. Source and destination addresses, DNS queries, URLs, and hashes pulled out of compound and nested values.
- ▸One beacon is one alert. The same indicator on the same agent is suppressed for an hour, so a repeated callback is not a storm.
- ▸Severity from the indicator. The feed confidence sets the finding level, so a high confidence hash outranks a low confidence address.
- ▸Standard fields. A match carries threat indicator type, value, provider, confidence and feed name in ECS.
Sixteen sources, and honest about all of them.
Every feed records when it last ran, how many indicators it produced and what failed. A source that quietly stopped updating is visible rather than trusted. Nothing is disabled to make a dashboard look tidy.
- ▸Run tracking is durable. Last run, duration, row count and error text per feed, kept across restarts.
- ▸Rotation, not unbounded growth. Indicators age out ninety days after a feed last listed them.
- ▸Air gap friendly. Feeds can be mirrored internally for a deployment with no outbound access.
- ▸Your own indicators too. Lists you maintain are queryable by the same operators as the feeds.
Your own lists sit beside the feeds, queried by the same operators.
Geography and ownership, attached at decode.
Every routable address is resolved to country, coordinates and autonomous system before a rule ever sees it, from a full city level database rather than a country only lookup. That makes geography a real field: filterable, chartable and correlatable.
- ▸City level source data gives country name, coordinates and the network operator, not just a two letter code.
- ▸Refreshed automatically so the database does not quietly go stale behind a green status light.
- ▸Correlation uses it. Impossible travel is a correlation over the country field, not a separate feature.
- ▸Which fields enrich is configuration held in an editable field group rather than compiled into the worker.
Attack origin, resolved at decode. The same field filters in Discover.
Bring an address you believe
never touched your network.
Give us an indicator from your last advisory. We will check it against your history and show you every event that carried it.
Powered by Codesecure Solutions. Self hosted, cloud or fully managed.