This phase ingests external signals, enriches them with context, maps them to business assets, and gives analysts a graph-driven view of which threats are relevant, urgent, and actionable. It turns noisy feeds into investigation-ready intelligence.
- Dark-web, credential leak, phishing domain, brand impersonation, and actor-monitoring feeds.
- IOC enrichment, asset relevance scoring, and severity logic aligned to business impact.
- Analyst investigation graph connecting threats, campaigns, infrastructure, and affected business units.