SECURIX Developed Product
Sec Alliance Threat Match
A managed threat intelligence service that alerts you to the external threats relevant to your organisation, from leaked credentials to exploited vulnerabilities, with prioritised actions mapped to MITRE ATT&CK.
Solution overview
Sec Alliance Threat Match delivers managed cyber threat intelligence focused on the external threats relevant to your organization. Security Alliance analysts monitor threat actors, malware campaigns, exploited vulnerabilities, leaked credentials and dark web activity, delivering curated alerts through the ThreatMatch Intelligence Portal. Alerts are matched to your intelligence requirements, ranked by severity and accompanied by context and recommended actions. SECURIX integrates the intelligence into your security environment, with the CSIS Cyber Defence Feed available as an addition for automated blocking and SIEM enrichment.
Your business needs
Know which external threats need your attention
Threats beyond your environment
Leaked credentials, lookalike domains and campaigns against your sector or suppliers develop outside your internal monitoring. They can remain unseen until they lead to an incident.
Intelligence without context
Raw threat feeds provide data, but turning it into decisions requires specialist analysis. Security teams need to know which threats matter to their organization and what action to take.
Vulnerability and supplier exposure
Exploits targeting your technology stack and breaches affecting suppliers can expose your organization. Teams need relevant intelligence to prioritize patches and assess supply chain threats.
Who this is for
Add external threat context to your security operations
For medium and large organizations with security monitoring in place but without their own threat intelligence team. The service is particularly relevant to organizations using a SIEM, SOC or managed detection service that can act on the intelligence.
CISO / Management
Periodic threat reports provide a view of the threat landscape for strategic decisions and risk reporting.
SOC / Security Operations
Curated alerts, threat profiles and indicators support investigations and the creation or tuning of detection rules.
IT / Risk / Compliance
Vulnerability and exploit intelligence supports patch prioritization. Supply chain monitoring, where included, provides insight into threats affecting suppliers.
Our deliverables
Threat intelligence with context and recommended actions
ThreatMatch provides analyst-curated intelligence through its portal and API, with regular threat reports available in the portal. Additional capabilities include the CSIS Cyber Defence Feed and optional SecAlliance services.
- Alerts specific to your organisationAlerts on compromised credentials, typosquatting, data leaks, dark web activity, relevant vulnerabilities, exploits, threat actors and malware. Every alert comes with severity, source, recommended action and an assessment of how relevant it is to your organisation.
- Analyst collaborationAsk the Analyst, comments, forums and chat enable direct collaboration with SecAlliance analysts. The portal provides control over who intelligence is shared with.
- API and security-tool integrationAn API mapped to STIX 2.1 and MISP, plus an enriched JSON feed for security tools. SECURIX integration services can integrate indicators into Elastic SIEM and firewalls and provide detection rules and dashboards based on threat intelligence.
- ThreatMatch intelligence portalProfiles of threat actors, malware, operations and incidents mapped to MITRE ATT&CK, including the ICS and mobile matrices. Attack scenarios support security testing and the tuning of controls.
- Threat reportingRegular reports in the portal and, depending on the agreed scope, tailored intelligence summaries and reports for your leadership team.
- Internal monitoring and incident response
- Vulnerability Scanning
- Threat-led penetration testing and red teaming
- Physical Security Intelligence
How we deliver
From your intelligence requirements to relevant alerts
-
During onboarding, we define the sector, technology stack, brands, domains and suppliers relevant to your organization.
-
SecAlliance analysts deliver organization-specific alerts and reporting through the ThreatMatch Intelligence Portal, based on those requirements.
-
Within the agreed scope, SECURIX connects ThreatMatch and Cyber Defence Feed indicators to Elastic SIEM and firewalls and provides detection rules and dashboards.
-
Security teams use the alerts and recommended actions in their investigations and detection work. Management uses threat reports to support strategic decisions.
Value begins with the first relevant alert after onboarding.
Additional capabilities
Extend the intelligence to match your requirements
CSIS Cyber Defence Feed
Available as an addition. Essential provides high-confidence malicious URLs and IP addresses for firewall and IDS/IPS blocklists. Advanced provides contextual data for SIEM, SOAR and threat intelligence platforms. Delivery is in JSON and CSV.
Domain and brand monitoring
Optional domain and brand monitoring, including takedowns.
Supply Chain Breach Monitoring
Optional monitoring of breaches affecting suppliers.
Further intelligence services
Optional external attack surface management, requests for intelligence and payment fraud monitoring.
Technology partners
Intelligence from Security Alliance and CSIS
Security Alliance develops ThreatMatch and provides analyst-curated intelligence. It is part of CSIS Security Group. CSIS provides complementary threat research and the Cyber Defence Feed. SECURIX sells, integrates and operationalizes the intelligence for customers.
-
CSIS Security Group
-
SecAlliance
Frequently asked questions
Before you introduce managed threat intelligence
The service is intended primarily for organizations with security monitoring and the capacity to act on alerts. A SIEM, SOC or managed detection service provides a starting point for using the intelligence in investigations and detection.
Onboarding defines your intelligence requirements, including sector, technology stack, brands, domains and suppliers. Alerts are matched to those requirements and include severity, context, recommended actions and an assessment of their relevance to your organization.
The CSIS Cyber Defence Feed can be added for automated blocking and SIEM enrichment.
No. Internal monitoring, detection, incident response and vulnerability scanning are separate services. ThreatMatch provides external threat intelligence to inform your security decisions and actions.
Contact
Let’s discuss your next step
Tell us which external threats concern your organization. Together, we’ll clarify your intelligence requirements and how the service can support your security operations.
