27 live feeds
Vulnerability intel (NVD, EPSS, CISA KEV), reputation (GreyNoise, AbuseIPDB, OTX), malware infrastructure (URLhaus, ThreatFox, Feodo Tracker), routing and radar telemetry — free and commercial, in one pipeline.
IOC normalization
IPv4, IPv6, domains, URLs, file hashes, JA3 fingerprints, and CVEs are extracted automatically from every entry, deduplicated, and stored with provenance and expiry.
Relevance over volume
The Feed Triage agent classifies each entry against your declared tech stack and brand. A KEV that matches your edge appliance becomes an alert; ten thousand entries that don't, cost you nothing.
TAXII 2.1 server
Indicators, threat actors, and alerts are served over a standard TAXII 2.1 endpoint — your SIEM, your MISP, your OpenCTI read from CTP247 like any other intel source.
News & advisories
Security news and vendor advisories are parsed from RSS, Atom, and JSON feeds, scored for relevance against your stack, and delivered alongside the machine-readable intel.
Hardening recommendations
CVE intelligence maps to the products you run and produces remediation playbooks — prioritized by EPSS exploit probability and KEV listing, not just CVSS arithmetic.
Declare your stack
Products, versions, brands, domains. This is the lens every feed entry is judged through — relevance is computed, not guessed.
Feeds ingest continuously
All 27 sources are polled on schedule, with feed-health monitoring in the admin panel so a silent feed never becomes a silent gap.
Entries are normalized
IOCs extracted, deduplicated, enriched with EPSS and KEV context, and tagged with MITRE ATT&CK techniques where the source supports it.
The agent triages
Each entry is classified against your stack: alert, watch, or discard — with the reasoning written into the record.
Everything is served back
Your tools subscribe over TAXII 2.1; your analysts query one IOC store; your weekly hunt draws from the same truth.
Under the hood