A threat intelligence platform with the context behind every indicator
Q-Feeds scores every indicator with the reasons behind its verdict, maps it to MITRE ATT&CK, ties it to the threat actors and malware behind it and links it to related infrastructure and CVEs. Investigate in the portal, or take the same context into your SIEM, TI platform and firewalls.
- ATT&CKEvery indicator mapped to MITRE ATT&CK
- STIX 2.1Context delivered over TAXII 2.1 and API
- 20 minRefresh interval on Premium
- 100%Made in Europe
What Q-Feeds adds to an indicator
A raw indicator only says that something was reported somewhere. Before it reaches you, Q-Feeds filters out known false positives, gives the indicator a verdict and a score with the reasons behind them, and adds the context an analyst would otherwise look up by hand.
The score, ATT&CK mapping, attribution and enrichment stay attached to the indicator wherever you use it: in the portal, in the IOC Lookup API and in STIX 2.1 over TAXII 2.1.
Follow the threat actors and malware behind the indicators
Q-Feeds maps indicators to MITRE ATT&CK groups and software. When the evidence names a group directly, the indicator is attributed to that group. When the only link is a set of overlapping techniques, Q-Feeds shows it as a hint, separately, so a guess never passes for attribution.
Each threat actor profile in the portal shows the group's activity over time in Q-Feeds data, the malware it uses and the campaigns MITRE ATT&CK attributes to it. Malware activity ranks families by indicators seen for the first time this week, with a 90-day trend, the latest indicators and the actors linked to each family. Families without new indicators for 30 days are flagged as dormant.
From indicator to vulnerability
Q-Feeds links indicators to the CVEs they relate to. Each CVE shows whether CISA lists it as known exploited, its EPSS score and whether a public exploit exists, so you can see when infrastructure in your logs ties back to a vulnerability that is being exploited.
The CVE catalogue is part of every package, the free Community edition included. On Plus and Premium, CVE alerts check every new CVE against the software you run and send a daily or weekly digest.
Indicator history and activity over time
Every indicator keeps its first seen and last seen dates, overall and per source, and the number of sources that reported it. A 30-day activity view shows whether it is still active, and portal statistics cover windows from 7 to 365 days.
What analysts see
Use the intelligence where you work
Investigate in the portal, or send the same intelligence to the tools that act on it.
Threat Lookup
Look up, search and pivot through indicators in the Threat Intelligence Portal.
IOC Lookup API
Verdict, score, ATT&CK context and linked indicators over REST, for SOC enrichment and automation.
TAXII Feeds & Server
Contextual STIX 2.1 collections over TAXII 2.1, hosted or on your own server.
TI Platforms
Add Q-Feeds as a source in OpenCTI, EclecticIQ, ThreatStream, ThreatConnect or MISP.
SIEM integrations
Match scored indicators against your events in Splunk, Microsoft Sentinel, Wazuh and other SIEMs.
Firewall integrations
Block scored indicators on FortiGate, Palo Alto, Sophos, Check Point, OPNsense and more.
For SOCs, MSSPs and enterprises
Larger teams want the intelligence inside their own tooling, at their own scale. Q-Feeds Enterprise licences are put together with you.
STIX 2.1 over TAXII 2.1
Contextual collections for TI platforms and SIEMs, with ATT&CK mapping, actor and malware attribution, enrichment and relationships.
IOC Lookup API
Verdict, score, ATT&CK context and linked indicators over REST, at the query volume your SOC needs.
Sized to your organisation
Users, firewalls, term, API volume and vulnerability scanning are scoped with you, not picked from a fixed tier.
Hosted in the EU
European data centres in the European Union, operated by Q-Feeds from the Netherlands.
Support for your NIS2 work
Threat intelligence and monitoring that help you meet your own NIS2 obligations for risk management and incident handling.
Help with implementation
Setup guides for every integration, and our engineers on a custom project when you need them.
Frequently asked questions about the Q-Feeds platform
Is Q-Feeds a threat feed or a threat intelligence platform?
A platform. The feeds are one of the ways the intelligence leaves it. Behind them, Q-Feeds scores, maps, attributes, enriches and links every indicator, and analysts work with that context in the Threat Intelligence Portal, through the IOC Lookup API and over TAXII 2.1.
How does Q-Feeds attribute indicators to threat actors?
Through MITRE ATT&CK. An indicator is attributed to a group when the evidence names that group directly. Overlapping techniques on their own only produce a hint, which the portal shows separately from direct attribution.
Does Q-Feeds link indicators to CVEs?
Yes. Indicators are linked to the CVEs they relate to, and each CVE carries its CISA KEV status, its EPSS score and whether a public exploit exists. The CVE catalogue is in every package.
How do I get this context into my SIEM or TI platform?
Over TAXII 2.1 as STIX 2.1, which carries the score, ATT&CK mapping, attribution, enrichment and relationships, or through the IOC Lookup API. Firewalls and DNS resolvers take the scored indicators as feeds.
Does Q-Feeds offer enterprise licences?
Yes. Q-Feeds Enterprise includes everything in Premium plus TAXII 2.1 access and the IOC Lookup API, with users, firewalls, term, API volume and scanning sized to your organisation. Contact us for a quote. TAXII 2.1 access and the IOC Lookup API are also available as add-ons.
What does Q-Feeds not do?
Q-Feeds does not publish analyst-written intelligence reports or geopolitical analysis, and it has no endpoint agent. Threat actor tracking is based on the indicators Q-Feeds observes, mapped to MITRE ATT&CK groups. Teams that need finished reports pair Q-Feeds with a provider that writes them.
Where is Q-Feeds hosted?
In European data centres in the European Union, operated by Q-Feeds from Hilversum in the Netherlands.
Evaluate our intelligence today!
Simplify your security operations, start your free Q-Feeds trial and experience the difference.
Start free