Essential Tools and Platforms for Cyber Threat Intelligence

A practical Cyber Threat Intelligence workflow relies on combining specialized sources for breach exposure, underground monitoring, malware sandboxing, infrastructure mapping, and structured sharing. Below is a reference list of widely used platforms.

Breach and Credential Leak Intelligence

• Have I Been Pwned: Checks whether email addresses or domains appear in known data breaches; useful for domain monitoring and user awareness.
• Hudson Rock – Cavalier: Tracks infostealer infections to identify compromised employee or third-party credentials and infected endpoints.
• DeHashed: Searchable breach database covering emails, usernames, IPs, hashes, and domains for exposure checks and incident triage.
• LeakPeek: Indexes leaked credentials and infostealer logs for domain monitoring and identity artifact enrichment.

Dark Web Monitoring and Marketplace Intelligence

• DarkOwl Vision: Indexed darknet data with dashboard and API access for threat hunting, brand monitoring, and underground investigations.
• Rapid7 Threat Command: Formerly IntSights; external threat intelligence, brand protection, dark web alerting, and takedown workflows.
• CyberSixgill: Deep and dark web collection with actor profiling, CVE exploitation tracking, and automated alerting.

General CTI Platforms and Enrichment

• MISP: Open-source threat intelligence platform for storing, correlating, and sharing IoCs, TTPs, and structured events.
• AlienVault OTX: Community threat intelligence platform for consuming and sharing indicator pulses.
• VirusTotal: Multi-engine file, URL, domain, and IP reputation aggregation for rapid triage and pivoting.
• Recorded Future: Commercial CTI platform providing real-time alerting, risk scoring, graph pivoting, and strategic reporting.
• Shodan: Search engine for Internet-exposed services and infrastructure fingerprinting.

Malware, Infrastructure, and IoC Analysis

• ANY.RUN: Interactive malware sandbox for dynamic inspection of executables, scripts, documents, and network calls.
• MalwareBazaar: abuse.ch repository of malware samples, hashes, and metadata for research and YARA rule validation.
• ThreatFox: Community-driven feed of timely IoCs maintained by abuse.ch.

Threat Actor and Campaign Tracking

• MITRE ATT&CK: Standardized knowledge base of adversary tactics and techniques for behavior mapping and detection engineering.
• Malpedia: Structured reference linking malware families, threat groups, and technical literature.