Log in Request a demo
Module · Cyber Threat Intelligence (CTI)

Threat Search & Investigation. Every IOC Tells a Story. We Help You Read It.

Threat search and investigation is the work of running an IOC lookup. You then follow the indicator's links to actors, infrastructure and campaigns. With Brandefense Threat Intelligence Platform, a single IP, domain, hash or email address opens into full actor profiles, campaign timelines and AI-guided pivot paths. The lookup ends in an answer, not a raw data dump.

Request a demo See Threat Intelligence
brandefense@threat-search:~ Example data
$ ioc.lookup --type=ip --value="203.0.113.47"
$ actor.pivot --from=infrastructure --depth=3
$ campaign.trace --actor="Scattered Spider"
$ graph.visualize --mode=threat_map
[+]14 RELATED NODES :: CAMPAIGN LINKED TO 3 ACTORS
$
$
What It Covers

Search. Any Threat Indicator.

Start with any known indicator. Follow the intelligence wherever it leads: across actors, campaigns, infrastructure and targets. The glossary entry on indicator of compromise explains what an indicator is. The guide to threat intelligence covers the wider practice.

  • ip:IP Address Lookup

    Instant enrichment for any IP. You see geolocation, ASN, hosting provider, linked domains and open ports. You also see past malicious activity, threat actor attribution and passive DNS records going back years.

    Passive DNSWHOISC2 Detection

  • domain:Domain Investigation

    Full domain history. It covers registration data, IP resolution timeline, certificate transparency logs and subdomains. It also covers malware distribution history, phishing kit links and lookalike domain cluster membership.

    WHOIS HistoryCert LogsPhishing Kits

  • hash:File Hash Analysis

    A hash lookup across MD5, SHA-1 and SHA-256 returns malware family classification and sandbox behavior reports. It also returns YARA rule matches, actor attribution, campaign links and static analysis data.

    MD5/SHA256YARA RulesSandbox Reports

  • email:Email & Identity Search

    An email address investigation shows credential exposure history and phishing campaign use. It also shows domain abuse links, dark web mentions and threat actor infrastructure registration patterns.

    Credential ExposurePhishing UseDark Web Mentions

Pivot from Any Node, Follow Every Thread.

Threat intelligence is only useful when it connects. Every search result becomes a launchpad for deeper investigation. Actors link to infrastructure. Infrastructure links to campaigns. Campaigns link back to techniques. Read actors in the threat actor landscape and CVEs in vulnerability intelligence. A scam ad domain is one more indicator. See fraudulent ad detection.

ioc_investigator.py :: LIVEExample data
> SEARCH_INPUT: 203.0.113.42
> TYPE: ipv4_address
> GEO: Example network / AS64496
> PASSIVE_DNS: 14 domains resolved
> THREAT_MATCH: C2_server [Cobalt Strike]
> ACTOR_LINK: TA-0312 [FIN7]
> CAMPAIGN: retail_sector_q1_2026
> PIVOT: 3 related IPs, 7 domains, 2 malware samples
Coverage

What Can Threat Search and Investigation. Do for an IOC Lookup?

Eight core capabilities that give threat intelligence and incident response teams one place to investigate.

01Unified IOC Search

One search interface for all IOC types (IP, domain, hash, URL, email, CVE, actor name). It answers in under a second. It uses the same enrichment format for every indicator type.

02Threat Graph Visualization

An interactive graph shows the links between IOCs, actors, campaigns and infrastructure. Complex threats become clear to analysts and executives alike.

03Bulk IOC Processing

Submit thousands of indicators via CSV, STIX 2.1 or API for batch enrichment and triage. This is essential for large-scale incident response, threat hunting campaigns and post-breach forensic analysis.

04Real-Time Intelligence Feeds

Subscribe to curated threat feeds filtered by sector, geography, TTP or actor. You get only the intelligence that fits your environment. You skip the noise of generic commercial feeds.

05SIEM & SOAR Integration

Splunk, Microsoft Sentinel, IBM QRadar, Cortex XSOAR, ticketing and other systems connect through the Brandefense API and Model Context Protocol (MCP). Enrichment and response run inside your existing workflows.

06Investigation Reports

One click produces an analyst-ready PDF report. It holds an executive summary, IOC tables, actor attribution, MITRE ATT&CK mapping and remediation recommendations.

07Threat Hunting Queries

Pre-built and custom threat hunting query templates are translated to Sigma, KQL, SPL and YARA. You can hunt for known actor TTPs and infrastructure patterns in your SIEM.

08REST API Access

REST API and MCP access with documentation and rate-limit management. It supports custom tooling and automation pipelines.

AI Modules

AI Modules. That Accelerate Investigation.

Four AI modules turn raw threat data into investigation intelligence. They cut analyst time-to-answer from hours to minutes.

  1. IOC Enrichment Engine

    An automated enrichment pipeline gathers context from 100K+ proprietary and open-source intelligence sources.

    More

    It removes duplicate and conflicting verdicts. It shows one confidence-weighted risk score. This ends the manual multi-tool lookups that use up analyst hours.

    100K+ SourcesConfidence ScoringDeduplication

  2. Pivot Recommendation Engine

    A graph neural network model reads the current investigation context.

    More

    It suggests the most useful next pivot steps. It surfaces hidden links between infrastructure, actors and campaigns. Otherwise these would take expert analyst intuition to find.

    Graph Neural NetworkContext-AwarePath Prediction

  3. Investigation Path Prediction

    Trained on thousands of completed threat investigations, this model predicts likely actor attribution and campaign scope from early signals.

    More

    Analysts can prioritize resources before the full graph is explored.

    Attribution PredictionScope EstimationEarly Signals

  4. False Positive Filtering

    Behavioral baseline models find shared hosting contamination, CDN false attributions and stale intelligence.

    More

    They suppress false positives automatically. Otherwise these would tire analysts and erode trust in threat intelligence feeds.

    CDN DetectionStale Intel FlaggingAnalyst Fatigue Reduction

Start. Investigating Threats Today.

Every IOC in your environment has a story. Brandefense Threat Intelligence Platform gives your analysts the tools to read it. Search across indicators, actors and exposed data. Follow the links between them. Reach a decision with the evidence in front of you.
Request a Demo
Key Takeaways
  • Threat search and investigation turns one indicator into actor, campaign and infrastructure context. The indicator can be an IP, domain, hash or email.
  • Brandefense Threat Intelligence Platform searches IP, domain, hash, URL, email, CVE and actor name in one interface.
  • Every result is a starting point for pivoting from actors to infrastructure to campaigns to techniques.
  • Native SIEM, SOAR and ticketing connectors keep enrichment inside existing response workflows.

Questions About Threat Search & Investigation.

Request a demo
Updated 10 Oct 2026
  • What is threat search and investigation?

    It is looking up an indicator, such as an IP, domain, hash or email. You then follow its links to actors, infrastructure and campaigns in one interface. The aim is context an analyst can act on, not a list of raw data.

  • Which indicators can be searched?

    IP, domain, hash, URL, email, CVE and actor name, in one search interface. Many indicators can be submitted together by CSV, STIX 2.1 or API for batch enrichment and triage.

  • Who uses threat search?

    Incident responders and threat hunters use it. They need answers fast during live incidents, threat hunting campaigns and post-breach forensics. They do not want raw data dumps to sift through.

  • Does it connect to existing security tools?

    Yes. SIEM, SOAR, ticketing and other tools connect through the API and MCP. So enrichment and response can run inside existing workflows. One-click investigation reports can also be generated for analysts.

  • What is an indicator of compromise?

    NIST defines indicators of compromise as technical artifacts or observables. They suggest an attack is about to happen or underway. They can also show that a compromise may have already occurred. They are clues that tell a team where to look.

  • How fast is a threat search?

    The unified search returns results in sub-second time, with a consistent enrichment format across indicator types.

  • Can many indicators be checked at once?

    Yes. Thousands of indicators can be submitted by CSV, STIX 2.1 or API for batch enrichment and triage. This helps in large incident response and threat hunting work.

  • What does an investigation report contain?

    One click produces an analyst-ready PDF report. It holds an executive summary, IOC tables, actor attribution, MITRE ATT&CK mapping and remediation recommendations.

  • What are threat hunting queries?

    They are pre-built and custom query templates translated to Sigma, KQL, SPL and YARA. You can hunt for known actor techniques and infrastructure patterns in your own SIEM.

  • How does the platform reduce false positives?

    Behavioral baseline models spot shared hosting contamination, CDN false attributions and stale intelligence. They suppress these. So analysts are not flooded with misleading hits.