Threat Intelligence

How Threat Intelligence Works

The Threat Intel module has three components working together:

1. IOC Watchlist — your organisation's master list of known-bad indicators. Every alert, SIEM event, and EDR detection is cross-referenced against this list automatically.

2. Feed Aggregation — four free threat feeds sync automatically:

• CISA KEV (Known Exploited Vulnerabilities)
• Abuse.ch URLhaus (malware URLs and C2s)
• Feodo Tracker (botnet C2 IPs)
• MalwareBazaar (malware hashes)

3. IOC Lookup — on-demand check of any IP, domain, hash, or URL against the watchlist and VirusTotal API.

IOC types supported

IP · DOMAIN · HASH (MD5/SHA1/SHA256) · URL · EMAIL

Managing the IOC Watchlist

Adding an IOC manually

1. Go to Threat Intel → IOC Watchlist
2. Click Add IOC
3. Enter the indicator — the type is auto-detected from the format
4. Set confidence (1–100%), tags (comma-separated), and optional notes
5. Click Add IOC — it appears immediately and starts being checked against new events

Bulk import

Click Export to download the current watchlist as CSV. To bulk import, prepare a CSV with columns: indicator,type,confidence,tags,notes and use the import endpoint:

curl -X POST https://portal.guardfoxsecurity.com/api/ti/import \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "[email protected]"

Auto-population from feeds

When a feed syncs, any new indicators are added to the watchlist automatically with the feed name as the source.

Removing an IOC

Click the trash icon on any row. IOCs can also be bulk-deleted by filtering and selecting multiple rows.

IOC Lookup with VirusTotal

The lookup tab checks any indicator against:

1. Local watchlist first (instant)
2. VirusTotal if not found locally (requires API key)

Setting up VirusTotal

1. Create a free account at virustotal.com
2. Go to your profile → API Key
3. In GuardFoxCopilot: Settings → Integrations → VirusTotal API Key
4. Paste your key and save

Free VT accounts have 4 lookups/minute. The Professional plan includes a higher-rate key.

Reading results

• Threat score bar — red (malicious) / yellow (suspicious) / green (clean)
• Engine count — out of 72 AV engines
• Permalink — opens the full VT report in a new tab
• Watchlist match — if found locally, shows confidence, tags, and analyst notes

Threat Feed Configuration

Syncing feeds manually

Go to Threat Intel → Feed Status and click Sync Now on any feed, or Sync All Feeds to refresh all four simultaneously.

Automatic sync schedule

Feeds sync automatically based on their update frequency:

• CISA KEV: daily at 02:00 UTC
• URLhaus: every 6 hours
• Feodo Tracker: every 6 hours
• MalwareBazaar: daily at 03:00 UTC

To change sync intervals, edit /api/ti/cron in your deployment config.

Adding premium feeds

Premium feeds (Recorded Future, Intel471, GreyNoise, Shodan) are configured in Red Team → Feed Marketplace. Enter your API key to connect.