Threat context

Review external signals alongside internal findings.

The threat workspace brings exploited-vulnerability context, feeds, indicators, matched assets, actor profiles, and an ATT&CK matrix into one view. Use it to inspect signals and correlate them with the assets and findings your team tracks.

Create a workspace
Threat intelligence workspace with exploited vulnerability, CISA KEV, feed, indicator, matched asset, and actor counts, plus overview panels.
Threat overview, correlation, and feed activity

Workflow

How it works

  1. 01Review exploited vulnerability and feed activity.
  2. 02Inspect indicators and ATT&CK context.
  3. 03Run correlation against tracked assets.

Related workflows