Solutions / Threat intelligenceObservatory /
Triage internet noise with protocol and campaign context.
Enrich scanner and exploit infrastructure with timestamped, explainable observations.
The job to be done
Investigate observed scanner and exploit infrastructure across protocols. Connect IP/ASN evidence, actor context and CVEs to an investigation while keeping behavioral labels separate from identity attribution.
What you get in five minutes
- Look up an IP or ASN and review its accessible observation window.
- Pivot from actors and CVEs in lookup evidence to filtered Console events and the API reference.
Every week
- Recheck infrastructure for changes in activity, protocol mix and last seen.
- Collect bounded observations through REST or the stream and compare them with your other sources; review the weekly activity and CVE digest.
Put the evidence to work
- Lookup
- Region, protocol and category counts, actor references, observed CVEs and bounded campaign identifiers where available.
- Events
- Inspect actor history and filtered observations within your plan window.
- API keys
- Keyed REST and SSE delivery for your own analysis; Enterprise adds bounded proprietary exports.
Choose the access you need
Public aggregates and the approved, free Researcher sample support exploration. Professional is required for full lookup evidence, event rows and the stream: at least a 15-minute delay and up to 30 days of event history. Enterprise offers no plan delay and up to 365 days of event history, subject to actual collection, with bounded exports.
Console → BillingStart with an observation.
Explore the free tiers, then choose the evidence and delivery your workflow needs.