Threat Intelligence Tools

About Threat Intelligence Tools

Threat intelligence platforms collect, correlate, and distribute indicators of compromise and adversary tradecraft data. The category covers threat intelligence platforms (TIPs) that store and manage IOC data, IOC sharing communities where organizations exchange threat indicators, and orchestration tools that automate enrichment of observables against multiple data sources. OpenCTI is a graph-based TIP that models threats using STIX 2.1 and provides a web interface for analysts to explore relationships between indicators, threat actors, and campaigns. MISP is a community-driven sharing platform where organizations exchange IOCs through trusted circles, with support for STIX, OpenIOC, and custom export formats. IntelOwl orchestrates enrichment by querying a single API against dozens of analyzers and external services, automating the manual work of looking up IPs, domains, and file hashes across multiple sources. AlienVault OTX provides a free community feed of threat indicators contributed by researchers worldwide, accessible via REST API and STIX/TAXII. The category feeds detection engineering and DFIR workflows, since IOCs from threat intelligence platforms populate blocklists, detection rules, and SIEM correlation queries. Tools in this category range from open source community platforms to commercial services with curated analyst reports.