CTI - Threat Intelligence
Threat intelligence across the Clear, Deep & Dark web
Analyst-verified threat intelligence on actors, ransomware, vulnerabilities, indicators and DDoS activity.
- Solution
- CTI - Cyber Threat Intelligence
- License
- No assets - generic by design
- API
- 5,000 calls a day - REST and TAXII 2.1
- Sources
- 30B+ data points indexed
How it works
Collect - Correlate - Verify - Distribute
Collect
Sweep every layer
Clear, deep and dark web, paste sites, forums and Telegram channels collected continuously.
All sources
Automated collection
- Clear / Deep / Dark web
- Stealer logs (50+ families)
- Dark markets (200+)
- Telegram & forums
- Breach dumps & combo lists
- Certificate Transparency
Premium feeds
- Third-party intelligence
- Open-source intel (OSINT)
- Global bots & sensors
DARKMON TIRU - Human intelligence
- Research, incident response
Correlate - Verify
Connect the dots
Indicators, actors, campaigns and vulnerabilities, cross-matched and verified by DARKMON TIRU analysts.
Correlation core
CTI
Human + machine
Distribute
Broadcast into your tools
Pre-classified intelligence served to your SIEM, SOAR and MISP through the REST API and TAXII 2.1, within 5,000 calls a day.
Unified intel
Classified & premium intel
- Prioritized, classified IOCs
- Threat actors, malware and ransomware tracking
- Vulnerability and DDoS intelligence
What's in the feed
Many sources. One verdict
- Clear web
- Deep web
- Dark web
- Paste sites
- Forums
- Telegram channels
Indicators of compromise
Proxies, VPN exits, Tor nodes, C2, phishing URLs and blocklists, with first-seen and last-seen dates.
Threat actors & ransomware
Leak sites of more than 3,000 threat actors refreshed daily, MITRE ATT&CK mapped.
Vulnerability intelligence
CVEs, exploits, zero-days and detections, ranked by real-world exploitability.
Pre-classified intel & news
A threat-landscape feed, triaged before it reaches you.
Malware & DDoS intelligence
Malware families linked to their actors, and DDoS trends by source country, target country and sector.
REST API & TAXII 2.1
STIX 2.1 objects over a read-only TAXII 2.1 server and the REST API, 5,000 calls a day.
Generic by design
One subscription. The same intelligence for every customer
Foresyn has no assets and matches nothing to your company. Where you also hold the other modules, it enriches the findings they make exploitability on Cresta vulnerabilities, actor context on Nyxel leaks, campaign links on Tellmark domains.
Foresyn
Single subscription - not asset-bound
- CrestaExploitability on every vulnerability it discovers.Asset-bound
- NyxelActor context on every leaked credential.Asset-bound
- TellmarkCampaign links on every look-alike domain.Asset-bound
- TresuraAttribution of the actor and campaign behind a carding operation.Asset-bound
Threat actor library
Know the adversary
Hacker groups, ransomware gangs and nation-state APTs, MITRE ATT&CK mapped. Leak sites of more than 3,000 threat actors, refreshed daily.
LockBit
- Ransomware
- Financial
- Global
ALPHV / BlackCat
- Ransomware
- RaaS
- Cross-sector
Cl0p
- Extortion
- Supply chain
- Global
Akira
- Ransomware
- Mid-market
- EMEA
Scattered Spider
- eCrime
- Social eng.
- Telco - Retail
Play
- Ransomware
- Double extortion
- Global
TTPs - MITRE ATT&CK mapped
Common uses
One feed, every workflow
Pick a workflow to see what Foresyn feeds into it.
- IOC Enrichment
Enrich every alert with adversary context
Pivot from a single indicator to the infrastructure, actor and campaign behind it before triage, not after.
- Proxies, VPNs, Tor exit nodes, C2 and phishing URLs
- Blocklists ready for your gateway and SIEM
- Actor attribution and MITRE ATT&CK mapping
- Incident Response
Respond with the full picture
When an incident hits, move from one indicator to the actor and campaign behind it and engage DarkOps DFIR directly.
- Threat actor profiles and TTPs
- Ransomware leak-site tracking refreshed daily
- Malware and DDoS attack intelligence
- Threat Hunting
Hunt across the underground
Sweep forums, Telegram and dark markets for chatter about your sector before it operationalizes.
- Pre-classified intel and landscape news feed
- Clear, deep and dark web sources
- Paste sites, forums and Telegram channels
- Vulnerability Priority
Patch what attackers actually use
CVEs ranked by exploits, zero-days and real-world exploitability the same intelligence Cresta correlates against.
- CVEs, exploits and zero-days
- Detections and real-world exploitability
- Enriches Cresta findings where you hold both
Integrations & API
Wires into the stack you already run
No connector is charged and no integration needs a license of its own. Intelligence reaches your SIEM, SOAR, MISP and threat intelligence platform through the REST API and TAXII 2.1.
5,000
Foresyn API calls a day. Every Foresyn API request and every TAXII poll counts one.
The web interface and the APIs of the other modules are never counted; packs add 5,000 a day more.
- REST APIOpenAPI 3.1, 296 endpoints covering every module you hold
- TAXII 2.1Read-only server serving STIX 2.1 indicators, intrusion sets, threat actors and vulnerabilities
- Cortex XSOARContent pack: indicator feed, enrichment commands and 20 playbooks
- OpenCTITen ready-made feeds for OpenCTI 6.7 or later
- SIEMSplunk, Microsoft Sentinel, IBM QRadar and Elastic, through the REST API or TAXII
- MISP & TIPsMISP, ThreatConnect, Anomali ThreatStream, EclecticIQ and ThreatQ, through TAXII 2.1
Threat Advisory Suite
The DARKMON TIRU advisory library is a module of its own
Advisories, flash advisories, TLP distribution and tailored threat advisory reports from the DARKMON Threat Intelligence Research Unit are Threat Advisory Suite, a CTI module licensed on its own. Foresyn carries no reports.
Threat Advisory SuiteAdvisory library
Published advisories and flash advisories on emerging campaigns, actors and vulnerabilities, with TLP distribution.LibraryTailored threat advisory reports
Customer-specific reports by DARKMON TIRU analysts: 12 a year in the base, plus packs and single reports.On request
FAQ
Straight answers
We already have a CTI feed. Why Foresyn?
Most feeds give you curated IOCs. Foresyn gives you the raw adversarial data the actual actor, the actual leak site, the actual channel plus the enriched IOC feed on top. Your analysts decide the level of abstraction.
Is Foresyn tied to our enrolled assets?
No. Foresyn has no assets and matches nothing to your company: it is generic by design, the same intelligence for every customer. Mentions matched to your company, including ransomware posts that name you, are Tellmark brand-mention monitoring.
How does it reach our tools?
Through the REST API (OpenAPI 3.1) and a read-only TAXII 2.1 server, plus the Cortex XSOAR content pack and ready-made feeds for OpenCTI. Splunk, Microsoft Sentinel, IBM QRadar, Elastic, other SOAR platforms, MISP and threat intelligence platforms connect through the REST API or TAXII. Integrations need no license of their own; every Foresyn API request and TAXII poll counts against 5,000 calls a day.
What does DARKMON TIRU add?
The DARKMON TIRU advisory library, flash advisories, TLP distribution and tailored threat advisory reports are Threat Advisory Suite, a CTI module licensed on its own. Foresyn carries no reports.
Where does the data come from?
Clear web: news, disclosures, repositories. Deep web: pastes, breaches, closed forums. Dark web: markets, onion sites, Telegram. More than 30 billion data points indexed.
Where is the intelligence hosted and who can read it?
Hosted in Switzerland under Swiss data protection law, or in-country where regulation requires it. Access follows the platform roles you assign, and users are unlimited.
Get in touch
See Foresyn on your own environment
See Foresyn against your own environment with full feature access for thirty days.