What signals does threat intelligence contribute to detection?
Your EDR, SIEM or email gateway tells you what is happening inside your environment. Threat intelligence answers what those tools don't know: who is behind an attack, whether an artifact has already been seen in other attacks and what usually comes next. Sources are not interchangeable, because each type provides a different signal:
| Source type | Examples | Signal it provides |
|---|---|---|
| Reputation and artifact analysis | VirusTotal, AbuseIPDB, URLhaus, MalwareBazaar, urlscan.io | Verdicts from engines and sandboxes, first and last seen dates, relationships between files, domains and IPs |
| Internet noise | GreyNoise | Whether an IP is a mass scanner hitting the entire internet or targeted activity |
| Actors, campaigns and vulnerabilities | Recorded Future, Google Threat Intelligence, Mandiant, CrowdStrike Intel | Attribution, tactics and techniques, reports and actively exploited vulnerabilities |
| Cybercrime, credentials and infostealers | KELA, SpyCloud, Intel 471, Flashpoint, Hudson Rock | Stolen credentials and cookies, access for sale and mentions of your organization on forums |
| Management and sharing platforms (TIP) | MISP, OpenCTI, ThreatConnect, Anomali ThreatStream, TAXII feeds | Aggregated, deduplicated indicators shared in STIX format |
| Infrastructure and passive DNS | DomainTools, SecurityTrails, Silent Push | Domain and resolution history to pivot from a single indicator to the attacker's entire infrastructure |
What does Ciberia detect with this intelligence?
- IOC reputation in every alert: the IPs, domains, URLs and hashes that appear in alerts from the EDR, the SIEM, the firewall or email are checked against the integrated sources and Ciberia Intel.
- Attribution: if the indicator or technique matches a known campaign, malware family or actor, the alert arrives with that context and its priority is adjusted.
- Known noise: an IP classified as a mass scanner does not deserve the same treatment as a connection to an active command-and-control server, and triage takes that into account.
- Retrospective hunting: with Ciberia's Threat Hunting, you can search the history to see whether a newly published indicator was already in your environment before it became known.
- Credentials and infostealers: intelligence on leaked credentials feeds Ciberia CTM's exposure alerts, with context and a recommended action.
Which response actions are orchestrated with this intelligence?
Intelligence sources are consulted; actions are carried out in the tools that protect your environment, depending on what each one allows:
- Block a domain, IP or hash on the firewall, proxy, email gateway or EDR.
- Add indicators to SIEM watchlists to detect new occurrences.
- Force a password change and revoke sessions when a valid leaked credential turns up.
- Record sightings or new indicators in your intelligence platform, for example MISP, if you use it to share with your sector.
- Open or update the case ticket with the intelligence context.
Everything follows Ciberia's flow: alert, context, decision (the AI proposes and an analyst validates anything with impact) and orchestrated action. Every automatic action is logged: who, when, on what criteria and on what data.
How does it differ from the other integrations?
The other integrations provide telemetry and response capability inside your environment: the EDR sees processes, identity sees sign-ins and email sees messages. Threat intelligence provides external context and doesn't see what happens on your network. On its own it detects nothing, because it needs something to be matched against, and without it every alert arrives with no way of knowing whether the artifact is already known. That's why it is the integration consulted most during triage and the one that executes the fewest actions directly.
How does it work with Ciberia Intel?
Ciberia Intel brings together proprietary and third-party intelligence on actors, campaigns, malware families, vulnerabilities, IOCs, reports, credentials and infostealers, the dark web and forums. If your company already subscribes to sources such as Recorded Future, KELA or SpyCloud, Ciberia integrates them and adds their context to Ciberia Intel's. Ciberia analyzes that information with AI built on its own architecture, on servers located in Spain and without relying on third-party LLMs.
