Threat intelligence for security teams
Give analysts the context behind an alert: the score and the reasons for it, the MITRE ATT&CK mapping, the threat actor and malware, linked infrastructure and related CVEs. In the portal and inside the tools you already use.
An IP address on a blocklist tells an analyst that something is bad, not why or what to do next. Q-Feeds scores every indicator with the reasons behind the verdict, removes known false positives and maps it to MITRE ATT&CK techniques, groups and malware, drawing on more than 2,500 commercial, OSINT and governmental sources.
Analysts investigate in the Threat Intelligence Portal, and the same context reaches your SIEM, SOAR and TI platform through TAXII 2.1 and the IOC Lookup API, so triage happens where the alert is.
Context for every alert
Threat Lookup
Single and bulk lookups of IPs, domains, URLs and file hashes, with verdict, reasons, score and the number of sources.
IOC Lookup API
The same verdicts, scores and ATT&CK context over REST, for your SIEM, SOAR or ticketing system.
STIX 2.1 over TAXII 2.1
Collections with ATT&CK mapping, attribution, enrichment and relationships for TI platforms and SIEMs.
Threat actors and malware
See which malware families and ATT&CK groups are active, with direct attribution kept apart from weaker hints.
Vulnerability intelligence
CVEs with CVSS, EPSS, CISA KEV status and public exploits, plus alerts for the software you run.
Feeds for detection
Curated IP, domain and URL feeds for Splunk, Microsoft Sentinel, Wazuh and other SIEMs.
Inside the tools you already run
Questions from security teams
How is this different from a plain blocklist?
A blocklist only says an indicator is bad. Q-Feeds adds the score and the reasons behind it, MITRE ATT&CK mapping, threat actor and malware attribution, enrichment such as GeoIP, ASN and WHOIS, linked infrastructure and related CVEs.
Can we use the intelligence in our SIEM or SOAR?
Yes. Feeds load into Splunk, Microsoft Sentinel, Wazuh and other SIEMs, STIX 2.1 over TAXII 2.1 carries the full context into TI platforms, and the IOC Lookup API enriches alerts from a SOAR playbook or ticketing system.
Does Q-Feeds write intelligence reports?
No. Q-Feeds does not publish analyst-written reports or geopolitical analysis, and it has no endpoint agent. Teams that need finished reports pair Q-Feeds with a provider that writes them.
Which licence does our team need?
Threat Lookup and the portal modules come with Plus and Premium, and Premium adds 20-minute updates, premium DNS data and malicious URLs. TAXII 2.1 and the IOC Lookup API come with Q-Feeds Enterprise or as add-ons.
Can we try it before we buy?
Yes. The free Community edition includes a 7-day Premium trial, or book a demo and we walk your team through the portal.
Evaluate our intelligence today!
Simplify your security operations, start your free Q-Feeds trial and experience the difference.
Start free