Threat Intelligence
Intel that enriches automatically, not on demand
ManySignal ingests STIX 2.1 bundles, TAXII 2.1 collections, commercial threat feeds, and internal IOC lists. Every observable on an incoming event is matched against the active indicator set at ingest time — not when an analyst asks.
STIX 2.1 indicator — ingest format
Native STIX/TAXII ingestion, no translation layer
STIX objects are stored natively. Indicator patterns compile to efficient matching structures at ingest time. Relationship objects link indicators to malware, threat actors, and campaigns — enriching entity graph nodes automatically.
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--8e2e2d2b-17d4-4cbf-938f-98c54d9b4ef3",
"name": "Malicious C2 IP - APT29",
"indicator_types": ["malicious-activity"],
"pattern": "[ipv4-addr:value = '198.51.100.42']",
"pattern_type": "stix",
"valid_from": "2026-01-01T00:00:00Z",
"valid_until": "2026-07-01T00:00:00Z",
"confidence": 90,
"labels": ["c2", "apt29"],
"relationship_refs": [
"threat-actor--56f3f0db-b5d5-431c-ae56-c18f02caf500"
]
}How threat intel integrates with detection and investigation
Ingest-time enrichment
When an event arrives, every extracted observable — IP, domain, hash, URL, email — is matched against the active indicator set. Matching indicators are attached to the normalized event as structured enrichment fields before the event reaches detection rules or the entity graph.
- Observable extraction from all common event types
- Sub-5 ms match latency against million-indicator sets
- Indicator expiry is respected — expired indicators do not enrich
Ingest-time enrichment
Detection rule references
Detection rules can reference intel match results directly: `event.intel.matched == true AND event.intel.confidence >= 80`. Rules can also filter by indicator type, label, or associated threat actor — so a C2 IP match from a specific APT campaign can trigger a higher-severity finding than an anonymous blocklist match.
- Filter by confidence score, label, or actor reference
- Campaign-aware severity escalation
- Intel-matched findings cite the specific indicator
Detection rule references
Agent investigation context
When the triage agent evaluates a finding, intel match data is available as a first-class evidence source: matched indicator name, associated threat actor, campaign context, and MITRE TTPs from the STIX relationship graph. The agent weighs this against behavioral and historical signals.
- Threat actor and campaign context visible in triage reasoning
- MITRE TTP annotations from STIX relationship objects
- Intel confidence propagated to overall verdict confidence
Agent investigation context
Threat Intelligence — FAQ
Which commercial intel feeds are supported?
Native connectors ship for Recorded Future, VirusTotal, Shodan, AlienVault OTX, and MISP. Any feed that exports STIX 2.1 or a CSV/JSON IOC format can be ingested via the universal feed connector with field mapping.
How are internal IOC lists managed?
Internal lists can be uploaded as CSV, imported via the API, or maintained in the platform's indicator editor. Lists support confidence scoring, expiry dates, and tagging for filtering in detection rules.
What happens when an indicator expires?
The indicator is removed from the active match set at its valid_until timestamp. Historical events that matched it retain the enrichment fields — expiry is not retroactive. You can extend expiry or mark an indicator as permanently valid.
Can I suppress intel matches for known-safe addresses?
Yes. Safe lists are maintained as high-confidence 'benign' indicators. A match against the safe list overrides a match against a malicious indicator, and the enrichment fields reflect the safe classification.
How does intel context enrich AI triage verdicts?
Intel matches are surfaced as answers to triage question set items — specifically the intel_match and actor_attribution questions. A finding that matches a known threat actor's C2 infrastructure receives a higher verdict confidence than a finding with no intel context, even if the behavioural signal is identical.
Is there a bundled free intel feed or do we need to provide our own?
ManySignal bundles a curated free-tier intel feed covering high-confidence IOCs from open-source sources (OTX, URLhaus, Abuse.ch, PhishTank). For commercial-grade enrichment with lower false-positive rates, Recorded Future and VirusTotal Intelligence integrations are available at additional cost.
How does ISAC or sector-specific intel get incorporated?
ISAC feeds distributed in STIX 2.1 or CSV format import via the universal feed connector. MISP instances can be connected directly. Sector-specific intel (FS-ISAC, H-ISAC, E-ISAC) is supported by any of these ingestion paths.
How does ManySignal handle high-false-positive intel feeds?
Each feed source carries a configurable trust weight that scales how strongly an IOC match contributes to a verdict. Low-trust feeds contribute a smaller weight — the triage agent considers the match as a weak signal rather than an automatic escalation trigger. You can also apply rate limiting on verdict impact per feed.
Can threat intelligence be shared across MSSP client tenants without exposing source feeds?
Yes. The MSSP intel-sharing feature lets parent tenants push curated IOC subsets to child tenants. Source feed metadata (attribution, confidence, feed name) can be stripped before sharing, so clients receive enriched verdicts without visibility into which commercial feeds the MSSP subscribes to.
Intel that arrives with the alert
See how ManySignal pre-enriches every finding with threat actor context, campaign data, and MITRE annotations.