Protoxol
Request a demo
Platform Modules Plans Blog Request a demo
TI · Module

Threat intelligence

IOC, reputation and actor context across every module.

Compare with 5 alternatives ↓

Overview

What TI does.

Threat Intelligence in Protoxol is a substrate, not a silo. Every IOC, every actor profile and every campaign signal automatically enriches alerts across EDR, NDR, SIEM and Email — so the analyst sees `185.220.* — TOR exit node, associated with APT28 since 2023` as context on the alert itself, not in a separate console.

Features

Inside TI.

Multi-source feeds

Commercial, open and internal feeds. Mix and score per use case.

Actor & campaign context

MITRE ATT&CK mapping. TTPs auto-attached to relevant alerts.

Confidence scoring

Suppress noisy feeds in some contexts, amplify in others. Tunable per rule.

Custom intel API

Ingest your internal threat intel via REST, MISP, TAXII or STIX 2.1.

Auto-enrichment

Every alert across every module enriched at write time. Zero lookup tax.

Use cases

Where TI earns its keep.

Alert triage acceleration

Context attached at alert creation shortens triage because the analyst does not have to look the indicator up.

Proactive hunting

Pivot from new IOCs to historical sightings across all modules.

Brand & supply chain monitoring

Track impersonation domains, leaked credentials, dependency advisories.

Technical specs

TI under the hood.

Feed formats STIX 2.1, MISP, TAXII, REST
Update frequency 5-minute pull, instant push
IOC types Hash, IP, domain, URL, certs, JA3
Coverage 20+ commercial + 50+ OSINT feeds

Figures from internal testing; test method and date to be published.

Compare alternatives

Protoxol Threat intelligence compared with five alternatives

An alert without context sends you to another console to learn whether an IP is a TOR node or belongs to a known actor. This comparison covers the threat intelligence module: where indicators come from, how they are scored, aged and shared, and how they reach the alert you review. Protoxol TI enriches alerts from other modules; the five products compared range from an intelligence service to platforms for managing your own.

What Protoxol offers

Comparison table

Each cell shows the status and the scope. Statuses are explained below the table.

Show alternative:

Scroll the table sideways to see every column.

Protoxol Threat intelligence compared with five alternatives
CriterionProtoxol Threat intelligenceRecorded Future Threat IntelligenceGoogle Threat IntelligenceThreatConnect Platform (Threat Intelligence Operations)Anomali ThreatStream Next-GenOpenCTI (Filigran)
Intelligence sources AvailableTakes commercial, open and internal feeds, mixed and scored per use case. No own collection is described. AvailableIndexes the open web, dark web, technical feeds and customer telemetry; collection is run by the vendor. ↗ AvailableCombines Mandiant, VirusTotal and Google intelligence; Enterprise adds Mandiant research reporting. ↗ AvailableOrganisation Communities and Sources, plus CAL, which aggregates anonymised data from participating instances. ↗ AvailableHundreds of open, commercial and community sources on a threat graph curated over years. ↗ AvailableBrings no sources of its own: imports through external connectors, TAXII, RSS, CSV or JSON feeds and enriches with connectors. ↗
Indicator types AvailableHash, IP, domain, URL, certificates and JA3. AvailableCollections of IPs, domains, URLs and hashes; also malware profiles, TTPs and actor infrastructure. ↗ AvailableFiles, URLs, domains and IPs, groupable into collections. ↗ AvailableTAXII ingest creates indicators (addresses, files, URLs) and groups (campaigns, actors, reports). ↗ Not confirmedIndicator types not detailed in the pages opened. AvailableObservables and indicators on a STIX 2.1 model. Concrete type list not reviewed. ↗
Actor and campaign context AvailableActor and campaign profiles mapped to MITRE ATT&CK; TTPs attach to relevant alerts. AvailableActor and malware profiles you can view by geography, industry and supply chain. ↗ AvailableEnterprise includes actor attribution, campaigns, malware families, threat profiles and strategic reporting. ↗ AvailableCampaign, actor and report groups that link to indicators inside the platform. ↗ Depends on setupIntelligence graph queried by AI agents. ATT&CK mapping and actor profiles not detailed. ↗ AvailableThreat actors, intrusion sets and campaigns, with TTPs and arsenal in the knowledge tabs. ↗
Indicator ageing and expiry Not confirmedThe pages do not describe indicator expiry or ageing. AvailableTAXII collections are generated at request time; refresh runs from one hour to one day by collection. ↗ Not confirmedIndicator expiry not documented in the pages opened. A real-time IoC Stream exists. ↗ AvailableActive or inactive status; confidence deprecation can set an indicator inactive when it reaches zero. ↗ Not confirmedContinuous maintenance of data is mentioned; the expiry policy is not detailed. Not confirmedThe docs link an indicator lifecycle section, but the validity detail was not read.
Confidence and false positives AvailableConfidence scoring tunable per rule to mute noisy feeds. A false-positive feedback flow is not described. AvailableRisk score per IOC available through the API. False-positive handling not confirmed. ↗ AvailableSTIX output carries objects with a threat score. False-positive handling not confirmed. ↗ AvailableThreatAssess (0 to 1000) drops with recent false positives, 7 days by default; CAL adds global reputation. ↗ AvailableNormalises, deduplicates and scores with machine learning and analyst review, and filters low-confidence data. ↗ Not confirmedConfidence scoring and false-positive handling not confirmed in the pages opened.
STIX and TAXII AvailableAccepts STIX 2.1 and TAXII as input. Serving TAXII to third parties is not described. AvailableTAXII 1.x and TAXII 2.1 with use-case collections; some SIEMs cannot ingest the vulnerability objects. ↗ Depends on setupSTIX through the API (output_format=stix) and collection export. TAXII server not confirmed. ↗ AvailableTAXII Ingest imports STIX 2.1 objects from TAXII 2.1 feeds (needs version 7.9.0 or later). Export not verified. ↗ AvailableOffers STAXX, a free on-premises STIX/TAXII solution (OVA). STIX and TAXII versions not detailed. ↗ AvailableTAXII feeds (pull and push) and connectors that convert to STIX 2.1 bundles. ↗
Own sources (REST, MISP) AvailableIngests internal intelligence via REST, MISP, TAXII or STIX 2.1. Needs integrationLists connectors to MISP, OpenCTI, ThreatConnect and Anomali. Loading your own feeds is not confirmed. ↗ Not confirmedEnterprise allows private IoC collections; loading your own external feeds is not confirmed. Depends on setupGeneric, per-feed or custom mappings in TAXII Ingest. REST and MISP not verified in the pages opened. ↗ Not confirmedAPI-first design with all intelligence reachable programmatically. Loading own feeds or MISP not stated. AvailableConfigurable MISP and TAXII connectors with URL and API key; CSV and JSON import. ↗
Integration with detection and other modules AvailableEach IOC enriches alerts at creation in EDR, NDR, SIEM and email, and lets you pivot to historical sightings. Needs integrationConnect API to enrich IOCs, correlate risk lists with logs and show alerts in Sentinel, Splunk or Google SecOps. ↗ Needs integrationAPI access (30,000 calls per day in Enterprise) and integrations such as Microsoft Sentinel. ↗ Not confirmedEnrichment towards SIEM or EDR and playbooks not verified in the pages opened. Needs integrationConnectors for SIEM, SOAR, firewalls, endpoint and vulnerability management (Splunk, Sentinel, QRadar, CrowdStrike). ↗ Needs integrationStream connectors push data to SIEM or XDR; detection happens in those tools. ↗
Sharing and communities (ISAC) Not confirmedSharing with ISACs or external communities is not stated. Only sharing own intel with peer teams is mentioned. Not confirmedSharing with ISACs or communities not verified in the pages opened. AvailablePrivate IoC collections with viewer or editor roles and sharing. Delivery to ISACs not confirmed. ↗ AvailableCommunities and Sources, plus group publishing between instances with the Cross-Intel Sharing app. Specific ISACs unverified. ↗ AvailableTrusted Circles to distribute finished intelligence to ISACs, partners and internal teams. ↗ Depends on licenceRole and marking controls for sharing; organisation segregation needs the Enterprise licence. ↗
Analyst workflow Depends on setupContext arrives inside the alert and you hunt from a new IOC. No dedicated intel report or case workspace is described. AvailableAlerts, customisable search, hunting packages and sandbox analysis inside the module. ↗ AvailableLivehunt YARA rules, retrohunt, private investigation graphs and daily or weekly digests per profile. ↗ AvailableLibrary of indicators and groups, statuses, confidence deprecation and discussion posts on each object. ↗ AvailableCase management: intelligence follows alerts and investigations, with AI agents querying the graph. ↗ Depends on licencePlaybooks, priority intelligence requirements and AI features are Enterprise Edition. ↗
Deployment and licensing Depends on setupModule sits in the Team plan; the platform runs as SaaS or on your infrastructure. Commercial feed licence terms are undefined. Not confirmedModule tiers, pricing and data-use terms are not public in the pages reviewed. Depends on licenceSubscription per edition (Standard, Enterprise, Enterprise+) with API call caps; IoC feeds are an Enterprise+ add-on. ↗ Depends on setupThreatConnect Cloud, Dedicated Cloud or on-premises. Licence and price not published in the pages opened. ↗ Depends on setupManaged service, standalone or embedded in the Anomali data lake. Price and licence not published. ↗ Depends on licenceSelf-hosted with Docker or Kubernetes; Community under Apache 2.0, Enterprise licensed by Filigran. ↗

What each status means

Available
Native feature of the product or plan compared.
Needs integration
Works through a connector or a third-party product.
Depends on setup
Exists, but its scope depends on deployment or configuration.
Depends on licence
Only in a higher plan or as a paid add-on.
Needs another product
Covered by a different product from the same vendor.
In development
Announced or being built; not generally available.
Not confirmed
Not enough evidence. It does not mean “no”.

Five comparisons

One per product, naming the plan that was compared.

Recorded Future Threat Intelligence

Plan or edition: Threat Intelligence module of the Intelligence Platform. Tier and price are not public; the cells describe the module, not the other modules.

Recorded Future collects the open web, dark web, technical feeds and customer telemetry itself, and delivers it through its API, STIX/TAXII collections and integrations with Sentinel, Splunk or Google SecOps. On volume and source coverage it is ahead: the Protoxol TI module describes no collection of its own and relies on the feeds you connect. The Protoxol difference is that the IOC shows up on the EDR, NDR, SIEM or email alert inside the same console. Recorded Future fits if your team investigates actors and spreads risk scores across several tools; Protoxol fits if you want context on the alert. Condition: module tiers and price are not public, so request a quote.

Official source ↗

Google Threat Intelligence

Plan or edition: Enterprise edition (Standard and Enterprise+ also exist). The cells state when something is Enterprise+ only.

With the Enterprise edition you get Mandiant reports, actor and campaign attribution, threat profiles, Livehunt rules, retrohunt and private graphs on top of VirusTotal. It is an investigation tool for CTI analysts, and Protoxol does not compete there: its TI module describes no sample analysis or malware corpus. What Protoxol offers is carrying the IOC as context onto each alert without you building the integration. With Google, delivery to your tools goes through the API, capped at 30,000 calls per day in Enterprise. Google fits if you already hunt with YARA; Protoxol fits if you want triage with context. Continuous IoC feeds are an Enterprise+ add-on.

Official source ↗

ThreatConnect Platform (Threat Intelligence Operations)

Plan or edition: ThreatConnect Platform in Cloud, Dedicated Cloud or on-premises. Edition not public; the cells describe the base platform.

If your daily job is managing intelligence (importing TAXII feeds, scoring indicators, ageing out old ones and publishing groups to other instances), ThreatConnect is built for that. Its ThreatAssess score drops with recent false positives and an indicator goes inactive once its confidence runs out. Protoxol TI does not describe that lifecycle management or sharing with communities; its value is that the IOC attaches to the alert in each module. ThreatConnect fits a CTI team with its own processes; Protoxol fits a SOC that wants context without another console. Condition: after the Dataminr purchase, product and brand integration is not yet defined.

Official source ↗

Anomali ThreatStream Next-Gen

Plan or edition: ThreatStream Next-Gen, standalone or within the Anomali data lake. Plan not public.

ThreatStream Next-Gen is sold as managed intelligence: Anomali maintains hundreds of sources, deduplicates, scores and filters low-confidence data, and you consume it in your SIEM, SOAR or EDR through connectors. It offers something the Protoxol TI module does not describe: Trusted Circles to distribute finished intelligence to ISACs and partners. In the other direction, Protoxol enriches the alerts of its own modules with no connector in between. Anomali fits if you run another vendor's SIEM and need an intelligence hub feeding it; Protoxol fits if you want the IOC on the alert from its own EDR or NDR. Condition: indicator types, price and licence model do not appear in the pages consulted.

Official source ↗

OpenCTI (Filigran)

Plan or edition: Community Edition (Apache 2.0). The cells state when something requires Enterprise Edition.

OpenCTI does not sell intelligence: it is the platform where you accumulate your own. You import through connectors (MISP, TAXII, CSV, JSON), model actors and campaigns in STIX 2.1 and push indicators to your SIEM with stream connectors. If you have engineers willing to build and maintain it, it gives you full control and the Community edition is free. Protoxol TI saves that setup but documents less room for customisation. Playbooks, priority intelligence requirements and organisation segregation need the Enterprise licence. OpenCTI fits a CTI team with an engineering profile; Protoxol fits a SOC with no time to run an intelligence platform. Condition: with no feeds of your own or purchased, OpenCTI starts empty.

Official source ↗

When to choose Protoxol

  • You want the IOC and actor context to appear on the EDR, NDR, SIEM or email alert itself.
  • You already have your own feeds or MISP and need to connect them to detection without building a separate platform.
  • Your SOC is small and has no dedicated CTI analysts managing the indicator lifecycle.

When to consider something else

  • You need your own collection from the dark web and forums, actor reports and attribution: Recorded Future or Google Threat Intelligence.
  • Your CTI team manages expiry, confidence deprecation and publishing to communities or ISACs: ThreatConnect or Anomali.
  • You have engineers and want an open knowledge platform modelled on STIX 2.1: OpenCTI.
  • You investigate samples with YARA rules and relationship graphs: Google Threat Intelligence.

See the module in a demo

Questions about this comparison

01Can I load my own IOCs into Protoxol TI?

According to the product pages, yes: internal intelligence ingest accepts REST, MISP, TAXII and STIX 2.1. Expiry of those indicators is not described, so confirm it in a demo.

02Does Protoxol TI replace an intelligence platform such as ThreatConnect?

No page claims that. The module enriches alerts and lets you hunt from an IOC; lifecycle management, reporting and ISAC sharing are not listed as capabilities.

03What about the licence of commercial feeds?

The pages do not define which commercial feeds are included or their terms of use. Ask who contracts the feed and which uses it allows before depending on it.

04What is the difference between buying an intelligence service and a platform?

A service such as Recorded Future or Google collects and analyses for you. A platform such as OpenCTI or ThreatConnect manages what you load into it. Many teams combine both.

Sources and review date

Reviewed on October 2, 2026. Reviewed by The Protoxol team.

Protoxol capabilities are based on the current commercial documentation on this site and were not technically validated in this review; anything undocumented is shown as “Not confirmed”. Vendor data comes from each vendor's public documentation on the date shown and may have changed.

Selection

See TI against your data.

Thirty minutes. Your environment. The modules that fit. No slideware.

Book a demo See pricing