Threat intelligence platform for CTI analysts and intelligence teams.
Collection that covers your requirements, actor tracking you can interrogate, and sources you can pivot through, with the underlying observations still reachable.
This page is for you if
- Your requirements are written, but you cannot name the source behind each one.
- You have handed over a report you could not defend when the follow-up question came.
- Report production is eating the hours you wanted for analysis.
- You are asked to prove the value of a function whose success case is an incident that did not happen.
What changes in an investigation
Threat actor tracking is the continuous collection and correlation of a group's infrastructure, tooling, victims, aliases and techniques, maintained as a profile that can be interrogated and pivoted from rather than read as a static report.
“The thing that convinced me was being able to get from an indicator to the actor's other infrastructure and back to our own telemetry without leaving the investigation.”
Threat Intelligence Lead Financial Services · 5,000+ employees · Gartner Peer Insights™ verified review
What you are dealing with, and what changes
This page is written for the reader who will open the source before believing the summary. Every row below can be checked against what the platform actually exposes.
Requirements are defined, but no sources reach regional and closed channels
Collection · Hacktivist IntelligenceCollection across forums, marketplaces, messaging platforms, leak and paste sites, repositories and social sources, with regional and language depth mapped to your requirements.
Requirements have sources behind them, and gaps are known rather than discovered after an incident.
A report you cannot test, pivot from, or defend in the room
Threat Actor Intelligence · Threat InvestigationActor profiles, campaign tracking, indicator search and pivoting, with the underlying observations accessible rather than abstracted away.
You answer the follow-up question in the room, and show your work.
Reporting production crowds out analysis
AI Report Manager · Custom Report BuilderAutomated collection, tagging and correlation, with prompt-driven report generation, scheduling and templates.
Analyst hours move from assembling intelligence to interpreting it.
The success case is an incident that did not happen
Reporting · Audit trailTraceable output captured as a matter of course: requirements answered, requests fulfilled, detections generated, stakeholder actions taken.
The function's contribution is evidenced in the same terms as every other team's.
Indicators without infrastructure context are dead ends
Indicator enrichmentExtended indicator coverage including JARM hashes with domain relations, phone numbers for smishing, and crypto wallet addresses, with cross-source confidence and signal strength.
Infrastructure tracking that survives a rotation of domains and IPs.
You don't need another dashboard
Findings arrive in the tools you already run. Marked ⇄ means bi-directional: status, severity and comments sync both ways, so closing it there closes it here.
Available through
ServiceNow ⇄ 
Jira ⇄ 
Slack ⇄ 
Microsoft Sentinel 
Splunk The browser extension enriches and analyses indicators in-page anywhere you are already reading, with STIX 2.1 export. The MCP server lets you run an investigation as a conversation.
AI that decides, explains itself, and learns your environment
Decides
AI agents decide whether an alarm should exist at all: evaluating infrastructure, content and visual signals before anything reaches your queue.
Explains
Every decision carries a step-by-step reasoning trail with full audit logs, so “why did this fire” and “why didn't it” are both answerable.
Adapts
Your analysts correct verdicts and explain why. The model adapts to your organisation, so tuning compounds instead of resetting.
Deliberately narrow claim for this audience: agentic automation handles Tier 1 classification and the collection, tagging and correlation work. Judgement stays with you, and every automated decision shows its reasoning so you can audit it rather than trust it.
Explore Agentic Threat IntelligenceWhat collection actually covers
Stated plainly, because “we monitor the dark web” is not a collection plan:
Forums, marketplaces, leak sites, paste sites, monitored messaging channels and infostealer log ecosystems, with regional and language depth.
Public repositories, social platforms and discussion sites on a short crawl cadence, with AI-enriched severity and entity extraction.
Curated premium feeds by region, sector, campaign, behaviour, CVE and malware, plus community and government sharing feeds.
Reference view, not live data. The free Threat Actor Database, Campaigns feed and IOC Radar show the same profiles and pivots without an account, which is the fastest way to judge collection depth for yourself.
Actor profile, pivoted from a single indicator
TrackedWhat our customers say.
50,000+ world-class brands and organizations across 150+ countries.
Questions we get in this role
How do you track threat actors targeting your organisation?
Actor profiles combine infrastructure, tooling, victims, aliases and techniques, and each is scored for impact against your assets, sector and geography. Profiles are pivotable: you can move from an indicator to infrastructure to actor to campaign, with the underlying observations still visible.
What sources should CTI collection cover?
Coverage needs to span criminal and closed sources such as forums, marketplaces, leak and paste sites, monitored messaging channels and infostealer log ecosystems, alongside open sources such as public repositories and social platforms, plus community and government sharing feeds. Regional and language depth determines whether requirements are genuinely covered.
How do you prove the value of a CTI function?
By capturing output as a matter of course rather than reconstructing it annually: requirements answered, requests fulfilled, detections generated and stakeholder actions taken. That produces the same class of evidence every other team reports on.
Can intelligence be exported into our existing CTI stack?
Yes. A TAXII 2.1 server serves STIX 2.1, with native MISP modules, an OpenCTI connector and partner integrations, plus hunting rule export in Snort and Suricata format with MITRE ATT&CK coverage mapping.
Where the analyst stays
This is the page where an overclaim costs the most, so the claim is kept narrow. Four things that do not move.
Automation is scoped to Tier 1 and to collection work
Classification, tagging and correlation are automated. Assessment, attribution judgement and the confidence language in your reporting are yours, and nothing on this page says otherwise.
The observation under the correlation stays reachable
Profiles are not a summary layer you have to trust. You can open the source observation behind any relation, which is what makes a finding defensible in the room.
Automated decisions show their reasoning
Every verdict carries a step-by-step trail of which signals were evaluated. You can audit a decision rather than accept it, and disagree with it on the record.
Your corrections are kept and applied
When you mark a verdict wrong and say why, that correction adapts the model for your organisation. Tuning accumulates with your judgement rather than resetting around it.
See SOCRadar in action.
A walkthrough run against your own requirements: your sectors, your regions, your priority actors. Not a canned dataset.
- Collection depth, checked live: pick a region or a language and see what the sources actually return.
- A pivot end to end: indicator to infrastructure to actor to campaign, with the observation open at each step.
- Export into your stack: STIX 2.1 over TAXII, MISP modules, OpenCTI connector, Snort and Suricata rules.
- Reporting automation: a report generated from a prompt, with the underlying findings attached.
Additional Resources
SOCRadar Threat Research Unit
Original investigations from our threat research team, including the current flagship analysis tracing a large-scale firewall credential-harvesting operation through to the extortion groups it supplied, with attribution methodology, tooling analysis and infrastructure mapping included.
Read the latest researchThreat Landscape Report library
Sector, regional and thematic research, including identity and sector-specific threat landscape analysis.
Browse reportsThreat Actor Database and Campaigns
Actor profiles with MITRE ATT&CK mappings, indicators and YARA rules, plus analyst-written breakdowns of active campaigns. Free, no account.
Explore profiles