Solutions / SOC teamsObservatory /
Triage internet noise with current exploit context.
Move from an alert IP to observed activity, confidence and evidence.
The job to be done
Separate routine scanning from exploitation using observed CVEs, techniques, protocol and recurrence. Use the evidence to prioritize an investigation and review a suggested action.
What you get in five minutes
- Paste an alert IP or ASN into Console → Lookup.
- Review last seen, confidence, evidence classes and the suggested observe, challenge or block-candidate action with a paid plan.
Every week
- Review observed activity and CVEs in the weekly digest.
- Revisit alert IPs and inspect Events by protocol, region or actor to check whether the evidence changed.
Put the evidence to work
- Lookup
- IP/ASN observations with timestamps, evidence and caveats; shared infrastructure calls for caution.
- Events
- Filter observations by protocol, region and actor; download bounded CSV or JSON results.
- Integrations
- Short-lived firewall block candidates with expiry and an organization allowlist, plus a versioned SIEM starter pack.
- Notifications
- Opt in to a weekly digest of observed activity, CVEs, blocklist changes and organization API usage.
Choose the access you need
Public and Researcher Console users can try a limited lookup preview. Professional unlocks full lookup evidence, events delayed at least 15 minutes, up to 30 days of event history and the stream. Enterprise removes the plan delay and adds bounded proprietary exports.
Console → BillingStart with an observation.
Explore the free tiers, then choose the evidence and delivery your workflow needs.