What are the ZeroFox Network and Vulnerability Intelligence Feeds?

ZeroFox’s Network and Vulnerability Intelligence Feeds provide IOCs and IOAs such as IP addresses and malware hashes indicating your organization’s network assets have been compromised. This information helps you keep your infrastructure security controls up to date and understand how to prioritize the mitigation of vulnerabilities.

What are the Covert Communications Intelligence Feeds?

ZeroFox’s Covert Communications Feeds have raw threat data providing you safe access into dark web forums, marketplaces, and covert channels used for selling breached data and planning cyber attacks.

How do the Threat Intelligence Feeds help protect my organization?

The threat data and information in the ZeroFox Threat Intelligence Feeds allows you to discover if your assets, people, or network devices, are at risk. Understanding exposure with contextual data allows you to quickly perform remediation by restricting unauthorized access into accounts and devices.

How do I use the Threat Intelligence Feeds?

Bring the Threat Intelligence Feeds directly into your security stack by way of integration with your SIEM, SOAR, TIP, ITSM, or other tools utilized by your security team. The feeds have flexible filters that allow you to correlate findings or data points in your network to known threats and IOCs. This provides your security team with additional insights that can be used to block IOCs, change passwords, and perform other remediation actions.

Request Demo

Threat Intelligence Feeds

Harness ZeroFox's cyber threat intelligence feeds to boost your SOC and threat intelligence team capabilities.

Get a Demo

Stay ahead of threats. Not behind them

Unlock a decisive edge with real-time insights from our global, proprietary, and correlated intelligence datagraph.

As you defend your perimeter, cyberattackers plot their next moves in unseen corners of the internet—underground forums and encrypted channels. If you're not proactively monitoring the broad threat landscape, you're already operating at a critical disadvantage.

Key Challenges Security Teams Face:

Blind spots in social media and dark web channels
Alert fatigue that hides critical threats within
low-value noise
Slow, manual threat identification processes
Intelligence siloed outside your core security infrastructure

Intelligence that anticipates. Insights that Empower

ZeroFox Intelligence Feeds eliminate critical security blind spots by delivering correlated threat intelligence that integrates seamlessly with your existing security tools. By combining proprietary collection technology with unparalleled dark web access, we enable your team to detect threats at their source and respond decisively—staying steps ahead of adversaries as they evolve.

Precision Intelligence: Meticulously prioritized and contextually enriched to drive confident decisions.
Early Detection: Identify emerging threats at inception, not after compromise.
Seamless Integration: Flows directly into your SIEM, SOAR, TIP, XDR, IAM solutions and broader security ecosystem.
Tailored Protection: Customized to your industry, digital footprint, and specific risk profile.

Intelligence that anticipates. Insights that Empower

Purpose-Built Intelligence Feeds

Zerofox Intelligence Feeds are strategically designed to address distinct threat scenarios—delivering precisely the right intelligence at the right moment to maximize your security team's effectiveness.

Identity & Fraud

Network & Vulnerability

Dark Web Intelligence

Protect Against

Account Compromise
Customer Fraud
PII exposures

What's Included

Botnet (Compromised Credentials)
Phone Numbers
Email Addresses
SSN/NCID
Compromised Credentials
Credit Cards
Breach Info

Integrate With

Active Directory
SSO
IAM
ID Protection
Account Database
Fraud Management

Learn More

How it Works

ZeroFox processes over 12 billion daily data points from social media, messaging platforms, code repositories, and dark web forums. Our expert analysts and advanced machine learning transform this data into actionable intelligence, seamlessly integrated into your security controls. Results: 80% less manual analysis and 40% faster response times.

Connect threat intelligence services with your existing security tools

ZeroFox delivers precise, real-time threat intelligence via our seamless API, effortlessly integrating with your SIEM, SOAR, TIP, or IAM security tools. Access dynamic feeds covering identity fraud, deep and dark web activities, and network vulnerabilities for comprehensive protection.

ZeroFox for Splunk enables organizations to visualize and analyze threats directly from the purpose-built Splunk App.

Integrates 300+ security solutions in order to act as a centralized hub for your entire infrastructure

Identify threats outside the firewall on the platforms where you do business everyday: such as social media and digital platforms.

The ZeroFox Active Directory Integration allows automated remediation actions to be taken on Active Directory users with known found instances.

Helps security teams accurately detect and prioritize threats across the enterprise, to respond quickly to reduce the impact of incidents.

Organizations use Swimlane SOAR to consume alerts generated by ZeroFox, initiate takedown processes, track requests, extract IOCs and pass them to their TIP or other security platforms.

With the ZeroFox Threat Feed integration, ThreatQ users can ingest, correlate and take action on attacks made against their organizations via social media.

The ZeroFox Okta Integration allows automated remediation actions to be taken on Okta users with known found instances of credential compromise.

Datadog provides cloud scale application monitoring and log management for cloud applications.

Provides orchestration of social media, digital platform threat detection, and investigations to provide alert and IoC integration via ZeroFox Threat Feed API.

Integrates social intelligence and fuses automation, orchestration, and response to enable organizations of any size to be more predictive, proactive, and efficient.

The ZeroFox Norton Lifelock Integration allows automated remediation actions to be taken on Norton Lifelock users with known found instances of credential compromise.

See all the integrations

Frequently asked questions

ZeroFox’s Identity and Fraud Intelligence Feeds contain billions of compromised credentials, stolen credit card account numbers, botnet stealer data, breach occurrence descriptions, and other critical information that adds depth to your threat hunting and analytics data lake.