What are the ZeroFox Network and Vulnerability Intelligence Feeds?

ZeroFox’s Network and Vulnerability Intelligence Feeds provide IOCs and IOAs such as IP addresses and malware hashes indicating your organization’s network assets have been compromised. This information helps you keep your infrastructure security controls up to date and understand how to prioritize the mitigation of vulnerabilities.

What are the Covert Communications Intelligence Feeds?

ZeroFox’s Covert Communications Feeds have raw threat data providing you safe access into dark web forums, marketplaces, and covert channels used for selling breached data and planning cyber attacks.

How do the Threat Intelligence Feeds help protect my organization?

The threat data and information in the ZeroFox Threat Intelligence Feeds allows you to discover if your assets, people, or network devices, are at risk. Understanding exposure with contextual data allows you to quickly perform remediation by restricting unauthorized access into accounts and devices.

How do I use the Threat Intelligence Feeds?

Bring the Threat Intelligence Feeds directly into your security stack by way of integration with your SIEM, SOAR, TIP, ITSM, or other tools utilized by your security team. The feeds have flexible filters that allow you to correlate findings or data points in your network to known threats and IOCs. This provides your security team with additional insights that can be used to block IOCs, change passwords, and perform other remediation actions.

Request Demo

Threat Intelligence Feeds

Harness ZeroFox's cyber threat intelligence feeds to boost your SOC and threat intelligence team capabilities.

Get a Demo

Stay ahead of threats. Not behind them

Unlock a decisive edge with real-time insights from our global, proprietary, and correlated intelligence datagraph.

Comprehensive

Extensive data sets deliver all the relevant intelligence to the security team for deep analysis, from unique historical data to the latest dark web research from our embedded operatives.

Accurate

Proprietary intelligence feeds provide unparalleled visibility into malicious infrastructure and exploits to illuminate attacks before they’re launched and prioritize security response.

Timely

Direct machine-to-machine access to raw and regularly updated ZeroFox intelligence delivers easy-to-consume threat data, speeding decisions and automating mitigation when every second counts.

Purpose-Built Intelligence Feeds

Zerofox Intelligence Feeds are strategically designed to address distinct threat scenarios—delivering precisely the right intelligence at the right moment to maximize your security team's effectiveness.

Identity & Fraud

Network & Vulnerability

Dark Web Intelligence

Protect Against

Account Compromise
Customer Fraud
PII exposures

What's Included

Botnet (Compromised Credentials)
Phone Numbers
Email Addresses
SSN/NCID
Compromised Credentials
Credit Cards
Breach Info

Integrate With

Active Directory
SSO
IAM
ID Protection
Account Database
Fraud Management

Learn More

How it Works

ZeroFox processes over 12 billion daily data points from social media, messaging platforms, code repositories, and dark web forums. Our expert analysts and advanced machine learning transform this data into actionable intelligence, seamlessly integrated into your security controls. Results: 80% less manual analysis and 40% faster response times.

Connect threat intelligence services with your existing security tools

ZeroFox delivers precise, real-time threat intelligence via our seamless API, effortlessly integrating with your SIEM, SOAR, TIP, or IAM security tools. Access dynamic feeds covering identity fraud, deep and dark web activities, and network vulnerabilities for comprehensive protection.

ZeroFox for Splunk enables organizations to visualize and analyze threats directly from the purpose-built Splunk App.

Integrates 300+ security solutions in order to act as a centralized hub for your entire infrastructure

Identify threats outside the firewall on the platforms where you do business everyday: such as social media and digital platforms.

The ZeroFox Active Directory Integration allows automated remediation actions to be taken on Active Directory users with known found instances.

Helps security teams accurately detect and prioritize threats across the enterprise, to respond quickly to reduce the impact of incidents.

Organizations use Swimlane SOAR to consume alerts generated by ZeroFox, initiate takedown processes, track requests, extract IOCs and pass them to their TIP or other security platforms.

With the ZeroFox Threat Feed integration, ThreatQ users can ingest, correlate and take action on attacks made against their organizations via social media.

The ZeroFox Okta Integration allows automated remediation actions to be taken on Okta users with known found instances of credential compromise.

Datadog provides cloud scale application monitoring and log management for cloud applications.

Provides orchestration of social media, digital platform threat detection, and investigations to provide alert and IoC integration via ZeroFox Threat Feed API.

Integrates social intelligence and fuses automation, orchestration, and response to enable organizations of any size to be more predictive, proactive, and efficient.

The ZeroFox Norton Lifelock Integration allows automated remediation actions to be taken on Norton Lifelock users with known found instances of credential compromise.

See all the integrations

Frequently asked questions

ZeroFox’s Identity and Fraud Intelligence Feeds contain billions of compromised credentials, stolen credit card account numbers, botnet stealer data, breach occurrence descriptions, and other critical information that adds depth to your threat hunting and analytics data lake.