sig pulseYour indicators in one graph, with the sources attached
Sig Pulse collects indicators of compromise from your feeds, your sharing partners, your sandbox, and your own DNS and proxy logs. It puts them in one graph of domains, IPs, file hashes, certificates and ASNs, and lets you pivot through it.
What changes for the analyst
An IP that shows up in four feeds is one node with four sources attached, not four rows in four tabs.
When a domain comes in, its passive DNS history, registration details, certificates and hosting are already attached, so the first pivot is already done.
Sig Pulse also suggests links. A model looks for infrastructure that was probably set up by the same operator: the same certificate, domains registered a day apart with the same name servers, the same URL path on a phishing kit. Each suggestion comes with a score and the evidence behind it. Nothing gets merged until an analyst accepts it.
Every node and edge records which source reported it and when, and exports keep that information.
Who it’s for
Threat intel teams of two to twenty people who spend part of every day copying values between a feed portal, a WHOIS lookup and a spreadsheet. Also SOC analysts who need to know quickly whether a domain in an alert has been seen before and what it connects to.
Where it runs
We host it in the US or the EU, or you run it in your own AWS or GCP account. Either way, you can query the graph with openCypher and export to STIX 2.1.