Use Case: SOC Operations
Threat intelligence enrichment
An alert fires with a suspicious IP. ManySignal queries Recorded Future, ThreatFox, and Shodan in parallel and returns: active Cobalt Strike C2, associated with APT29 campaign from 3 weeks ago, 4 other customers affected. All in 8 seconds.
IOC context at detection time, not investigation time
Threat intelligence lookup is one of the most mechanical parts of alert investigation: take the suspicious IP, submit it to VirusTotal, wait, record the result, submit it to Shodan, wait, cross-reference with your TIP. An experienced analyst does this in 10-15 minutes per IOC. ManySignal does it in 8 seconds, for every IOC in every alert, before the alert arrives in the analyst queue. By the time the analyst opens the alert, the threat context is already there.
pipeline: threat_intel_enrichment
trigger: alert.new (any source, any severity)
ioc_extraction:
- from: alert.indicators (ip, domain, hash, url, email)
parallel_queries:
- virustotal: hash_reputation, url_scan, domain_reputation
- recorded_future: risk_score, threat_actor, campaign
- shodan: open_ports, service_banner, vulnerability_count
- threatfox: malware_family, c2_framework, first_seen
- misp: custom_feeds, isac_feeds
- cisa_kev: exploited_vulnerability_check
- spycloud: credential_breach_data (email iocs)
output:
- risk_score: 0-100 composite
- threat_actor: attribution if available
- campaign: linked_incidents_same_infra
- verdict: benign / suspicious / malicious + confidence
latency: < 10 seconds for full enrichmentThreat intel enrichment FAQ
Which threat intelligence sources does ManySignal integrate with?
Commercial feeds: Recorded Future, Mandiant Advantage, CrowdStrike Falcon Intelligence, Palo Alto AutoFocus. Open source: MISP, OTX AlienVault, ThreatFox, Abuse.ch URLhaus, MalwareBazaar. Vulnerability: CISA KEV, NIST NVD, Exploit-DB. DNS/IP: VirusTotal, Shodan, Censys, DNSDB. Specialized: PhishTank, SpyCloud for credential intelligence. All sources are normalized into a unified IOC model.
How fresh is the threat intelligence in ManySignal's pipeline?
Critical feeds (Recorded Future, CISA KEV, ThreatFox) update in near-real-time via streaming API. Standard feeds update every 15-60 minutes. IOC lookups are performed at alert time against the live feed, not a cached snapshot — so an IOC that appeared in a feed 5 minutes ago is available for enrichment of the current alert.
Does ManySignal correlate threat intelligence to identify active campaigns?
Yes. When multiple alerts share IOCs from the same threat actor campaign, ManySignal links them as a campaign cluster and surfaces the campaign context. This helps analysts understand whether they're seeing opportunistic scanning or targeted attack behavior.
Can organizations contribute their own threat intelligence to ManySignal?
Yes. Organizations can import custom STIX/TAXII feeds, upload indicator lists in CSV or JSON format, and connect to industry ISAC feeds. Internal threat intelligence created from past incidents (attacker IPs, malware hashes, phishing domains) is automatically added to the organization's custom feed and applied to all future alerts.
Every IOC enriched in 8 seconds before the analyst opens the alert
20+ threat intel sources queried in parallel at alert time — not during manual investigation.