Capabilities Threat intel and Leak Engine
Capability · Threat intelligence
Intelligence that goes looking for you.
Most threat-intelligence feeds end up as a list nobody has time to read. ApexAI brings your feeds into one hub, decides what each indicator is good for, hunts new indicators across the alerts you already have, and ties leaked accounts and exposed assets to the entities they belong to.
Status: Preview The threat-intel hub, feed connectors, CVE prioritisation and automatic IOC hunting run on real data today; the deeper leak-mining engine runs in observe mode and raises no notices yet.
The problem with feeds
A security team rarely lacks threat intelligence. It lacks the time to turn it into action. Commercial feeds, open-source lists, a sharing community and a vendor portal each bring thousands of values a day, in different formats and with different levels of trust. Some are worth blocking on, some are only worth a look, and some are just context that becomes noise the moment it is treated as a verdict.
At the same time, two of the most useful signals sit outside the SOC altogether: what an attacker can see of your organisation from the internet, and which of your accounts have already turned up in a leak. When those facts are not tied to the hosts and users behind your alerts, they stay in a separate report.
What ApexAI does with intelligence
One hub for every source
Commercial intelligence, STIX/TAXII 2.1 collections, open-source threat-intel platforms and curated open feeds are synchronised into one place, on a schedule, with the last success and last error of each source in view.
Each indicator given a role
Every value is normalised and judged for what it is good for: worth blocking, worth hunting, or context only. Being listed somewhere is reported as listed, never as proof that something is malicious.
New IOCs hunted automatically
When a new indicator arrives, ApexAI checks the alerts and entities it has already seen and re-examines the cases that hold it, so intelligence reaches back in time instead of only matching what comes next.
Vulnerabilities in context
Public vulnerability data, including known-exploited lists and exploit likelihood, is matched to the assets you actually expose and prioritised with the reasons written out.
Leaks linked to your assets
Credential and data leaks that concern your own domains are tied to the user and host entities they affect, and hunted against your alerts.
Raise, never excuse
Outside intelligence can make a case more urgent. It never closes a case or lowers its priority on its own.
From a new indicator to a finding
01
Collect
Feeds and platforms you connect are pulled in on their own schedule; values are cleaned, typed and de-duplicated.
02
Select
Each indicator is given a role, so block-worthy values, hunt leads and background context are kept apart.
03
Hunt back
New indicators, exposed vulnerabilities and leaked accounts are hunted across your stored alerts and entities.
04
Cite
Every hit becomes a finding that names its alerts and its intelligence sources, and is marked as found by the AI until a person confirms or dismisses it.
05
Feed the case
Findings flow into the entity case and its brief, where they sit beside the behaviour evidence rather than replacing it.
How credentials and your data are treated
- Passwords from leaks are never stored in plain text, never written to logs and never shown on screen or in notices.
- Leak searches cover only the domains and addresses your organisation owns and has verified.
- Automatic lookups that would send one of your values to a third-party service are off unless you switch them on; scheduled feed downloads only bring data in.
- Private addresses, internal names and your own domains are never sent out when a case is enriched.
- Keys for every intelligence source come from your environment and are never shown or logged.
Sources by category
| Category | Examples of what it brings | How it is used |
|---|---|---|
| Commercial threat intelligence | High-confidence indicators with actors and malware families, for example CrowdStrike Falcon Intelligence | Selection, hunting, case context |
| Threat-intel platforms and sharing | STIX/TAXII 2.1 collections and open-source intelligence platforms you already run | Selection, hunting, case context |
| Open feeds | Curated, screened open-source lists of malicious URLs, command-and-control and malware indicators | Hunting and context, weighed by measured value |
| Vulnerability intelligence | Public CVE records, known-exploited lists and exploit likelihood | Prioritising exposed assets |
| Attack surface and leaks | External asset discovery and leak monitoring for your own domains | Linking exposure and leaked accounts to entities |
Questions
Can I connect the threat-intel platform we already run?
Yes. ApexAI reads STIX/TAXII 2.1 collections and common open-source intelligence platforms, alongside commercial intelligence such as CrowdStrike Falcon Intelligence and a screened catalogue of open feeds.
Does a hit on a blocklist mean an alert is malicious?
No. A value that appears on a list is reported as listed. Whether a case is an attack is decided from the behaviour evidence, and intelligence can only add weight, never close a case.
Does ApexAI store leaked passwords?
No password is ever stored in plain text, logged or shown. Leaked accounts are linked to your user entities so you can act on them, without the password being exposed again.
Does any of our data leave our environment for enrichment?
Only when you allow it. Automatic outbound lookups are off by default, internal values are never sent, and leak searches are limited to your own verified domains.
See ApexAI on your own alerts.
A walkthrough with your team, in observe mode first: ApexAI scores and proposes, nothing acts on its own.