EclecticIQ Intelligence Center
Automate threat intelligence management and analyst workflows with the analyst-centric Threat Intelligence Platform.
With EclecticIQ Intelligence Center, your Cyber Threat Intelligence (CTI) team’s productivity soars as they accelerate their entire intelligence lifecycle and boost your CTI and SOC teams’ detection and response.
EclecticIQ Intelligence Center is the only Threat Intelligence Platform (TIP) that unites machine-powered threat data processing and dissemination with human-led data analysis without compromising analyst control, freedom, or flexibility.
Using an advanced threat intelligence manager, curated threat detection content and intelligence feeds, pre-built integrations and developer tools, and a collaborative analyst workbench, your analysts can collect and process data, create and share cyber threat intelligence, and supercharge detection and response.
Why choose intelligence center?
Main Capabilities
-
Intelligence Manager
Create a single source of truth for collaboration and analysis.
Intelligence Manager consolidates vast amounts of internal and external structured and unstructured threat data in diverse formats from open sources, commercial suppliers, and industry partnerships. This data becomes your collaborative, contextual intelligence source of truth.
Our unique data processing pipeline ingests, normalizes, transforms, and enriches this incoming threat data into a complex, and flexible data structure. Next, our technology optimizes and prioritizes this data to help you identify the most critical threats more rapidly.
For total flexibility, Intelligence Manager disseminates intelligence as reports for stakeholders or as machine-readable feeds that integrate with third-party controls to improve detection, hunting, and response.
Intelligence Manager offers cloud-like scalability and cost-effectiveness within your trusted environment.
-
Analyst Workbench
Tools to analyze, produce and collaborate on threat intelligence
Conduct deep threat investigations using advanced search queries, intuitive graphical link analysis, and support for leading CTI frameworks, standards, and libraries that help your analysts identify the tactics, techniques, and procedures (TTPs) of sophisticated threat actors.
Analyst Workbench supports the entire investigation process starting with augmenting existing intelligence by quickly adding or editing STIX 2.1-compatible data from within the workbench. Analysts can pull content directly from the web while browsing threat intelligence with an integrated browser extension.
Next, you can easily share dynamic results for a specific topic or area of interest with your team members via a collaborative workspace. Finally, you can assign tasks within that workspace to speed up investigations.
-
Integrations and API/SDK
Integrate with any feed, enricher, sharing community or security tool
Intelligence Center includes pre-built integrations for:
- Industry-leading threat intelligence feeds (e.g. Flashpoint, Group-IB, Intel 471, Kaspersky, Recorded Future and Silobreaker).
- Incident response solutions (e.g. ServiceNow)
- Security controls (e.g., IBM Security QRadar SIEM, Microsoft Azure Sentinel, Splunk Enterprise Security, IDS/IPS, EDR).
- SOAR (e.g., IBM Security QRadar SOAR, PaloAlto Networks Cortex XSOAR, and Splunk SOAR).
- Sharing and collaboration solutions (e.g., MISP, ISACs and other groups using STIX/TAXII 2.1 standards and other data formats).
- Extracting STIX 2.1 data from unstructured reports via NLP (e.g. Feedly, Elemendar)
- Check out our comprehensive list of pre-built Integrations.
Driving our integrations is a REST API and an extensible SDK for custom development with complete documentation, examples, and tools. For more details, feel free to visit our Developer Portal.
Intelligence Manager Features
-
Scalable Ingestion and Fusion of Threat Intelligence
Structured and unstructured threat intelligence ingestion, normalization, and entity extraction using our robust and scalable engine.
Read moreStructured and unstructured threat intelligence ingestion, normalization, and entity extraction using our robust and scalable engine.
-
Aligned with Industry Standards STIX 2.1 and ATT&CK
Threat intelligence aligns with industry standards for extensive compatibility and analyst enablement.
Read moreThreat intelligence aligns with industry standards for extensive compatibility and analyst enablement.
-
Manual and Automated Threat Data Enrichment
Manual and automated rule-based enrichment of threat intelligence from world-leading data providers to quickly add context.
Read moreManual and automated rule-based enrichment of threat intelligence from world-leading data providers to quickly add context.
-
Rule-based Automation and Knowledge Packs
Configurable or pre-configured automation for auto-tagging and workflow automation to speed investigations.
Read moreConfigurable or pre-configured automation for auto-tagging and workflow automation to speed investigations.
-
Dissemination and Exchange of Threat Intelligence
Empower a broad audience with automatically disseminated report feeds, technical feeds or custom threat intelligence feeds.
Read moreEmpower a broad audience with automatically disseminated report feeds, technical feeds or custom threat intelligence feeds.
-
Control of Confidential Data
Manage information sharing by TLP level and anonymization capabilities.
Read moreManage information sharing by TLP level and anonymization capabilities.
ANALYST WORKBENCH FEATURES
-
Intelligence Prioritization and Alerting
Prioritize analyst work according to alerts on intelligence that meets your requirements.
Read morePrioritize analyst work according to alerts on intelligence that meets your requirements.
-
Powerful Graph Exploration and Editing
Expedite investigations by exploring, creating, and editing threat intelligence with powerful graph visualization.
Read moreExpedite investigations by exploring, creating, and editing threat intelligence with powerful graph visualization.
-
Guided Search
Move through intelligence rapidly with guided auto-complete and advanced search query capabilities.
Read moreMove through intelligence rapidly with guided auto-complete and advanced search query capabilities.
-
MITRE ATT&CK Mapping and TTP Tracking
Track adversary tactics and techniques with MITRE ATT&CK search and mapping.
Read moreTrack adversary tactics and techniques with MITRE ATT&CK search and mapping.
-
Threat Report and Entity Editing
Exceed stakeholder expectations by editing and publishing professional-looking threat reports and curating your threat intelligence ... Read more
Exceed stakeholder expectations by editing and publishing professional-looking threat reports and curating your threat intelligence knowledge base.
-
Collaborative Workspaces and Tasking
Shorten investigations with workspaces that enable analysts to organize dynamically around a topic or case, collaborate via tasks, and ... Read more
Shorten investigations with workspaces that enable analysts to organize dynamically around a topic or case, collaborate via tasks, and share datasets and graphs.
Turn-key integrations and API/SDK features
-
Detection, Hunting, and Response for Leading SIEMs
Empower detection, hunting, and response on leading SIEMS with EclecticIQ apps that provide bi-directional integration.
Read moreEmpower detection, hunting, and response on leading SIEMS with EclecticIQ apps that provide bi-directional integration.
-
MISP Bi-directional Support
Leverage MISP for community threat intelligence with our unique bi-directional MISP integration and data change synchronization.
Read moreLeverage MISP for community threat intelligence with our unique bi-directional MISP integration and data change synchronization.
-
Default Integration with EclecticIQ JSON, STIX, and CSV
Integrate with any third-party security control by using industry standards like STIX 2.1, CSV, and EclecticIQ JSON.
Read moreIntegrate with any third-party security control by using industry standards like STIX 2.1, CSV, and EclecticIQ JSON.
-
An Ever-expanding List of Integrations
Over 80 integrations of open and commercial sources intelligence feeds, security controls, SOAR systems, IR, and sharing and ... Read more
Over 80 integrations of open and commercial sources intelligence feeds, security controls, SOAR systems, IR, and sharing and collaboration solutions.
Checkout the extensive list of pre-built Integrations -
API & SDK
Developers can supercharge their EclecticIQ Platform and extend the reach of their intelligence practice by designing new enrichment ... Read more
Developers can supercharge their EclecticIQ Platform and extend the reach of their intelligence practice by designing new enrichment scenarios, ingestion and export of new data sources, and more significant data model support.
HIGH-SECURITY ENVIRONMENTS AND ENTERPRISE READINESS
EclecticIQ supports the most targeted organizations in the world. For this reason, we deliver deployment models and core capabilities to meet the needs of high-security government and enterprise deployments.
-
On-premises, Hosted, and Hybrid Environments
Flexible implementations with support for any architecture with on-premises, hosted, and hybrid environments.
Read moreFlexible implementations with support for any architecture with on-premises, hosted, and hybrid environments.
-
Data Diodes for Unclassified to Classified Data Transfer
Industry-leading support for transferring threat intelligence through multiple information classification levels with data diodes.
Read moreIndustry-leading support for transferring threat intelligence through multiple information classification levels with data diodes.
-
Scalability to Match Your Needs
Maximize ROI by scaling EclecticIQ Intelligence Center components to suit your data and high availability needs.
Read moreMaximize ROI by scaling EclecticIQ Intelligence Center components to suit your data and high availability needs.
-
Retention Policies for Compliance with GDPR and Agency Policies
Enforce retention policies by automatically removing threat intelligence according to pre-set thresholds.
Read moreEnforce retention policies by automatically removing threat intelligence according to pre-set thresholds.
-
Threat Intelligence Feed and System Health Monitoring APIs
Track feed and system health by Integrating into your system monitoring tools.
Read moreTrack feed and system health by Integrating into your system monitoring tools.
-
Robust Authorization and Authentication Controls
EclecticIQ Intelligence Center delivers granular role-based access control (RBAC) with built-in two-Factor authentication and connectors ... Read more
EclecticIQ Intelligence Center delivers granular role-based access control (RBAC) with built-in two-Factor authentication and connectors for SAML, OAUTH, and LDAP.
Related packages
-
EclecticIQ Intelligence Center
EclecticIQ Intelligence Center is the only threat intelligence solution that unites machine-powered threat data processing and dissemination with human-led data analysis without compromising analyst control, freedom, or flexibility.
Download Product Description -
The Tradecraft of a Successful Threat Investigation: A COVID-19 Case Study
What does it take to run a successful threat investigation with global implications? Since February 2020, we at EclecticIQ have tracked adversaries as they put their malicious tactics, techniques, and procedures (TTPs) into high gear to take advantage of organizations shifting focus from security to the COVID-19 health crisis.
Download White Paper