// threat_intelligence

Real-Time Threat Intelligence

Actionable threat data with enriched CVEs, IOC feeds, and daily intelligence debriefs. Every threat is tracked from discovery through remediation with CVSS scoring, EPSS exploit prediction, and CISA KEV cross-reference.

344 threats_tracked
10,168 indicators
327 enriched_cves
Daily intel_debriefs

Curated Threat Feed with Severity Classification

Every threat is published with a severity rating, category tag, associated CVEs, MITRE ATT&CK techniques, and enriched metadata. Filter by severity, search by keyword or CVE ID, and sort by date to find what matters to your environment.

severity_classification

Four-tier severity model (Critical, High, Medium, Low) based on exploitability, blast radius, and active exploitation status. Each threat receives a composite score reflecting real-world risk.

cvss_epss_scoring

CVSS v3.1 base scores from NVD combined with EPSS exploit probability percentiles. Know not just severity, but how likely a vulnerability is to be exploited in the wild within 30 days.

cisa_kev_status

Cross-referenced against the CISA Known Exploited Vulnerabilities catalog in real time. KEV-linked threats are flagged for immediate attention and mandatory federal remediation deadlines.

category_tagging

Threats tagged by category: ransomware, supply chain, zero-day, APT, phishing, credential theft, lateral movement, C2 infrastructure, and more. Build filtered views by campaign type.

mitre_mapping

Every threat is mapped to MITRE ATT&CK tactics and techniques. See which techniques are trending, identify detection gaps, and prioritize engineering effort by technique frequency.

enriched_descriptions

Analyst-written descriptions covering attack chain, impact, affected products, known threat actors, and recommended mitigations. No raw CVE text — every entry is contextualized.


10,168 Indicators of Compromise Across Three Categories

IOCs are extracted from each threat and organized into network, file, and behavioral categories. Every indicator is tagged with its source threat, confidence level, and first-seen timestamp for SIEM integration.

network_indicators

  • IP addresses (C2 servers, scanning infra)
  • Domains (phishing, DGA, staging)
  • URLs (payload delivery, exfiltration)
  • CIDR ranges and ASN associations
  • DNS records and domain fronting configs

file_indicators

  • SHA-256 and MD5 hashes
  • Filenames and file paths
  • PE metadata and import hashes
  • Certificate thumbprints
  • YARA rule identifiers

behavioral_indicators

  • PowerShell and command-line patterns
  • Registry key modifications
  • Process injection techniques
  • Scheduled task creation signatures
  • Living-off-the-land binary usage

327 CVEs Enriched with NVD, EPSS, and CISA KEV Data

Raw CVE identifiers are enriched on ingestion with data from the National Vulnerability Database, FIRST EPSS scoring, and CISA's Known Exploited Vulnerabilities catalog. The result is prioritized vulnerability context that goes far beyond a CVE number.

vulnerability scoring patch_status
cve_idCVE-2026-22812
cvss_score8.8 / 10.0
epss_score0.943 (94th %ile)
kev_statusIN KEV
cweCWE-94: Code Injection
affectedOpenCode < 0.2.22
Vulnerability prioritization, not just enumeration. CVSS tells you severity. EPSS tells you exploit likelihood. KEV tells you it is being exploited. Together, they form a triage signal that separates the 327 vulnerabilities that matter from the 200,000+ that do not.
NVD integration EPSS percentile CISA KEV CWE mapping patch tracking affected products exploit maturity

Automated Daily Intelligence Debriefs

Every night at 11:59 PM EST, the platform generates a debrief summarizing new and updated threats, severity breakdowns, MITRE technique coverage, IOC distribution, and threat actor attribution. Subscribe via email or browse the archive with a 365-day heatmap calendar.

heatmap_calendar

365-day activity grid showing daily threat volume. Five intensity levels mapped to purple shading. Click any day to jump directly to that debrief.

trend_sparklines

30-day trend lines for threat volume, severity distribution, and detection coverage. Spot emerging campaigns and shifts in adversary behavior before they escalate.

severity_breakdown

Each debrief includes severity counts with visual indicators. Track the ratio of critical-to-low threats over time to measure the evolving risk landscape.

CRIT: 4 HIGH: 7 MED: 3 LOW: 1

email_subscription

Opt in from your profile to receive the debrief in your inbox every morning. Terminal-aesthetic email with severity badges, MITRE stats, and a direct link to the platform.


Threat Discovery and Validation Pipeline

The Research Lab is where new threats are discovered, validated, and published. Analysts submit threat descriptions in natural language, and the platform extracts structured intelligence: IOCs, MITRE techniques, CVEs, detection rules, timeline events, and severity classification.

automated_extraction

Submit raw threat intelligence and receive structured output: IOCs categorized into network, file, and behavioral groups. CVEs are auto-enriched, MITRE techniques are mapped, and detection rules are generated in SPL, KQL, and Sigma formats.

one_click_deploy

Validated threats deploy directly to the live platform with auto-generated TL-2026-NNNN identifiers. The deploy pipeline inserts into threats, IOCs, detections, MITRE mappings, timeline events, and tags in a single transaction.


Six-Tab Threat Detail View

Click any threat in the feed to open a detail panel with six tabs covering every angle: overview, detections, indicators, MITRE mapping, timeline, and references.

overview detections indicators mitre timeline references
threat_idTL-2026-0270
severityCRITICAL
categorySupply Chain Attack
cvesGHSA-69fq-xp46-6x23
mitreT1195.002, T1059.001, T1071.001
ioc_count34 indicators
detectionsSPL + KQL + Sigma
published2026-04-07

Threat Intelligence FAQ

What types of IOCs does Threadlinqs track?

Threadlinqs tracks 10,168 IOCs across three categories: network indicators (IP addresses, domains, URLs, C2 infrastructure), file indicators (SHA-256 hashes, MD5 hashes, filenames, file paths), and behavioral indicators (TTPs, PowerShell commands, registry keys, process chains).

How does CVE enrichment work?

Each CVE is enriched with NVD data including CVSS base scores, EPSS exploit probability scores, CISA KEV status for known exploited vulnerabilities, CWE weakness classification, patch availability, and affected product information. Currently 327 CVEs are enriched in the platform.

How often are daily debriefs published?

Daily debriefs are generated automatically at 11:59 PM EST every day. Each debrief aggregates new and updated threats, computes severity breakdowns, MITRE technique coverage, IOC distribution, and threat actor attribution. Subscribers receive the debrief via email.

Is the threat feed free to access?

Yes. The full threat feed with severity filtering, category search, and MITRE ATT&CK mapping is available on the free Blue tier. IOC correlation, daily debriefs, and detection rule export require a paid subscription starting at $4.99/month.

Start Tracking Threats Today

Access 344 threats, 10,168 IOCs, and 327 enriched CVEs. The threat feed is free. No credit card required.

[ browse_threats ] [ view_pricing ]