Enrich each log and alert with domain and IP risk.
Your security information and event management (SIEM) tool collects logs and alerts, and many of them hold domains, URLs and IPs. The question is what your analysts know about them. Take new findings from Threat Feed or Category Feed, and look up the rest with the Query API.
SIEM threat intelligence is domain, URL and IP risk data, plus content categories for domains, URLs and millions of IPs, that a SIEM tool uses to enrich logs and alerts. alphaMountain provides it as URL Classification (92 content categories), Threat Feed (a 1.0 to 10.0 risk score) and Domain/IP reputation factors. A feed is a downloaded list of new findings, and you choose what it carries: Threat Feed by score range, Category Feed by category.
Enrich each log with three kinds of context.
- Domains and URLs: a risk score plus one of 92 content categories.
- IP addresses: a risk score, plus a content category for a subset of IPs.
- Reputation factors: registration records, popularity and DNS history, so an analyst can see why a score is high.
A score of 1.0 is very safe and 10.0 is known malicious. Scores from 7.0 to 8.49 are suspicious, so warn or block based on your risk appetite. Scores of 8.5 and up are malicious, and we recommend blocking them.
Start with the riskiest domains and IPs.
Use the score to rank alerts, so analysts can start with the highest-scoring domains and IPs. For example, your team might raise an alert at 8.5 and up and flag a score from 7.0 to 8.49 for review. For threat hunting, an analyst can look up a domain or IP from raw log data and see what your subscription covers.
Call it for one lookup, or keep a copy.
An analyst or a script can call the Query API for a one-time lookup. It returns what your subscription covers, a category or a risk score, from a database that updates every hour. For heavy enrichment, run a local database (DB) copy as a database that your own systems query. The Batch API sends batch updates to your local DB copy every hour, delivered as Category Batch or Threat Batch.
What each feed carries.
Choose what the feed carries. Threat Feed delivers new findings in the score range you choose, 7.0 and up by default. Category Feed delivers new findings in the categories you choose, such as phishing. Each feed lists only those findings.
Count domains and IPs, not events.
A busy SIEM tool sees many events, each with several domains and IPs, so lookups add up fast.
- Up to about 100,000 lookups a day: the Query API alone fits.
- Above that: we recommend batch. The Query API handles up to 300,000 a day, but your local DB copy keeps response time under your control.
Choose the feed for your tool.
Choose Threat Feed, Category Feed or both. Tell us the score range or the categories your searches need, and we'll scope the feed to match.
Try it first.
Ask for a free trial, and we'll help you run a proof of value. You can look up a domain in threatYeti right now. If a verdict looks wrong, site owners can report a false positive. We score domains, URLs and IPs, not files.
FAQ
Can an analyst look up a domain or IP from a log?
Yes. Call the Query API with the domain or IP. It returns what your subscription covers, a category or a risk score. The API page lists the fields in each database.
Do you enrich file hashes or attachments?
No. We score domains, URLs and IPs, not files.
Does it work with our SIEM tool?
Your analysts and scripts can call the Query API, and the feed carries new findings by score range or category. Tell us which SIEM tool you run, and we'll confirm how you load the feed.
Bring your log volume.
Tell us how many events your SIEM tool handles and how many domains and IPs they hold. We'll match the products, delivery and licensing to it.