Threat Intelligence Screens

The Threat Intelligence menu gives you four screens that look up information in ThreatWinds, the threat intelligence service behind UTMStack: Indicators, AI Analyst, Triage and Report. Use them to check whether an IP address, domain, URL or file hash is known to be malicious, to see which values from your own alerts ThreatWinds knows, and to share an indicator you found.

An indicator (also called an IOC, indicator of compromise) is a value such as an IP address, domain, URL or file hash that is linked to malicious activity.

Before you start

• Every user with the threatintel.read permission can use all four screens. The Administrator, Analyst and Viewer roles all have it.

• Your server must be registered with the UTMStack update server (cm.utmstack.com), which happens during installation, and must be able to reach it over HTTPS. Otherwise the screens show Threat Intelligence isn't configured. See Threat Intelligence: How Indicator Alerts Work.

• Each screen sends what you search for, paste or report to ThreatWinds. The Indicators screen also sends the most frequent values from your alerts. Read What is sent to ThreatWinds on the page Threat Intelligence: How Indicator Alerts Work before you use them.

Indicators

Go to Threat Intelligence > Indicators.

What the page shows

The header shows how many indicators were matched in your env: values from your own alerts that ThreatWinds knows. To find them, UTMStack takes up to 1,000 of the most frequent IP addresses, host names, domains, file hashes, URLs and email addresses from both sides of your tenant's top-level alerts and asks ThreatWinds which of them it knows. This list is refreshed every 5 minutes at most.

When none of your values is known (and you have not set a search, filter or time range), the page shows general ThreatWinds data instead and says No instance indicators — showing generic data.

• IOC matches: the number of indicators per family: IP, URL, Domain and Signatures.

• Lookup any indicator: paste an IP address, domain, hash, URL or CVE (a published vulnerability ID) and press Enter or click Lookup. With the type menu on Any type, the indicator list below is narrowed to matching indicators. Pick a type in the menu (ip, domain, hostname, url, md5, sha1, sha256, sha3-256, cve, email-address, threat or malware) to look the value up directly: if ThreatWinds knows it, its details open. Clearing the box and pressing Enter brings back the full list.

• Export IOCs: downloads every indicator that matches the current search as a CSV file with id, type, value, tags, lastSeen, reputation, bestReputation, worstReputation and accuracy.

Tabs

Use the search box, the time range (Last 15 min, Last 1 hour, Last 24 hours, Last 7 days, Last 30 days or All time; default All time), Filters (type, reputation from −3 to 3, accuracy from 0 to 3, tags to include or exclude, date range) and Refresh to narrow the list.

Reputation

ThreatWinds rates each indicator from −3 to 3:

Accuracy says how sure ThreatWinds is, from Level 1 to Level 3.

Indicator details

Click an indicator to open its details. The top shows its type, reputation, accuracy, value, description and tags. Below that:

• Timeline: First seen and Last seen.

• Network / origin: Country, City, ASO (network owner) and ASN (network number).

• Associations: linked indicators with their reputation (up to 12 listed).

• Geolocations: places linked to the indicator (up to 6 listed).

• On the right, the AI brief box (ThreatWinds' description of the indicator and when it was last observed) and the Reputation box (Current, Best and Worst reputation, and Accuracy, each with its score).

Network / origin, Associations and Geolocations are hidden when they have no data. About and Activity appear only in a threat actor's details, not an indicator's.

AI Analyst

Go to Threat Intelligence > AI Analyst. This is an analyst workspace where you ask an AI agent about indicators. "The agent queries ThreatWinds directly and shows its work."

• Conversations: start one with New conversation. Conversations are saved on your UTMStack server, per tenant and user.

• Model: Silas 1.7 Pro (default), Silas 1.6 Pro or Silas 1.6.

• Results: entity details, relationship graphs and maps that the agent finds appear in this pane.

The AI Analyst is a threat intelligence tool. It is separate from the SOC-AI assistant that works on your alerts (see SOC-AI Assistant).

Triage

Go to Threat Intelligence > Triage to check a list of indicators in one go.

1. 1

   Paste the indicators

   Paste IP addresses, domains, URLs or hashes into Indicators, one per line or separated by commas. Defanged values such as 1.2.3[.]4 and hxxp:// are accepted. Up to 500 indicators are checked per run.

2. 2

   Run

   Click Triage. UTMStack looks up 6 indicators at a time and shows the progress. Click Stop to stop, or Clear to start again.

3. 3

   Read the verdicts

   Verdict	Meaning
   Malicious	Reputation −3 or −2.
   Suspicious	Reputation −1.
   Unknown	Reputation 0.
   Benign	Reputation above 0.
   Not found	ThreatWinds does not know the value.
   Unrecognised	The value is not a recognised indicator.

4. 4

   Export

   Click Export CSV for all rows, or Export STIX for a STIX file (a standard format for sharing threat intelligence). The STIX file includes only malicious and suspicious rows.

Report

Go to Threat Intelligence > Report to publish an indicator to the ThreatWinds graph.

Click Report indicator. The receipt shows when the indicator is live in the ThreatWinds database; this can take a while.

Common tasks

Check an address from an alert

1. Open the alert on Threat Management > Alerts and copy the address from the Parties tab.

2. Go to Threat Intelligence > Indicators. Under Lookup any indicator, set the type menu to ip, paste the address and press Enter.

3. If ThreatWinds knows it, its details open. Read Reputation (−3 Alarming to 3 Trustworthy), Accuracy, Last seen, the Associations (linked threat actors, malware and other indicators) and the AI brief.

4. Write what you found in the alert's Notes.

An unknown address is not proof that it is harmless. It only means ThreatWinds has no record of it.

Check a list of indicators from a report or an email

1. Go to Threat Intelligence > Triage.

2. Paste the indicators into Indicators. Defanged forms such as hxxp:// or 1.2.3[.]4 are accepted. The box counts the unique indicators it found ("12 unique indicators"); above 500, only the first 500 are checked ("Capped at 500 per run.").

3. Click Triage and wait for the progress to finish.

4. Read the Malicious and Suspicious rows first.

5. Search your own data for them: on Threat Management > Alerts with Add filter > Adversary IP or Adversary domain, or in Log Explorer (see Log Explorer Query Cookbook).

6. Click Export STIX to hand the malicious and suspicious indicators to a firewall, an email gateway or a partner that reads STIX, or Export CSV for a spreadsheet.

See which of your own alerts involve known bad indicators

Open Threat Intelligence > Indicators. The number "matched in your env" counts values from your alerts that ThreatWinds knows. Set a time range and filter on Reputation to list the worst ones, then click an indicator for its details. Remember that opening this page sends up to 1,000 values from your alerts to ThreatWinds (see Before you start).

Share an indicator you confirmed

Use Threat Intelligence > Report only for indicators you are sure about and that are not internal. Fill Indicator and Reputation, add Tags and Notes that explain what you saw, and click Report indicator. Wait for the receipt to say the indicator is live.

Troubleshooting