Search Any Indicator. See Who Is Behind It.
An alert often gives you one IP, domain, file hash or email address and little else. Responders and hunters then check many tools by hand to learn what it is. This use case puts the lookup, the context and the next step in one place.
- Domainlogin-acme-support.example Resolves here
- File Hash9f2c4e…b7a1 Contacted it
- Actor Handle@example_actor Linked actor
One Indicator. Many Answers.
Threat search and investigation is the work of taking a single indicator, such as an IP address, domain, file hash or email address, and following its links to actors, infrastructure and campaigns. Brandefense offers one search interface for these indicator types, a graph of the links and bulk submission, so analysts get context rather than raw data.
- 01 One Indicator, Many Tools Learning what an IP or hash is means checking several sources by hand. During a live incident that manual lookup work costs analysts time they do not have.
- 02 Raw Data Without Context A bare indicator does not say which actor or campaign it belongs to. Responders need answers they can act on, not data dumps to sift through.
- 03 Thousands Of Indicators At Once After a breach or during a hunt, teams hold long lists of indicators. Checking them one at a time does not scale.
From One Alert. To The Whole Picture.
One search box, one result format, and a graph to follow the links.
- Search Any Indicator Enter an IP, domain, hash, URL, email, CVE or actor name in one search box and get results in the same format for each type.
- Follow The Links Open the graph to see how the indicator ties to actors, infrastructure and campaigns, and pivot from one node to the next.
- Hand It On Submit lists by CSV, STIX 2.1 or API, send results to your existing tools and generate an investigation report.
What Changes Once It Runs.
- Faster Answers Analysts see what an indicator is and what it connects to in one place, instead of switching between tools.
- Clear Context For Each Alert Results show the actors, campaigns and infrastructure linked to an indicator, so the next step is easier to choose.
- Work That Fits Your Tools Connectors for SIEM, SOAR and ticketing tools let enrichment run inside the workflows your team already uses.
Read One Result. Part By Part.
Every result has the same shape, whatever you searched for. Here is what each part tells an analyst.
- 203.0.113.45 1
- Hosting: Example Hosting Ltd. 2
- Related: login-acme-support.example 3
- Seen before: phishing infrastructure 4
- Linked actor: Example Actor 5
- Open Graph · Send To SIEM · Report 6
- 1 The Indicator What you searched for and its type. An IP, domain, hash, URL, email, CVE or actor name all open in the same format. Read More →
- 2 What It Is Context for the type you searched. For an address: hosting. For a domain: registration history. For a file hash: the malware family.
- 3 Linked Infrastructure Related domains and addresses on the same infrastructure. Each one is a pivot you can follow. Read More →
- 4 Past Activity Earlier malicious use of the indicator, so you can tell a one-off from a known pattern. Read More →
- 5 Actor And Campaign The group and campaign linked to the indicator. A link is based on evidence and judgment, not certainty. Read More →
- 6 Next Step Open the graph, send the result to your SIEM, SOAR or ticketing tool, or generate an investigation report. Read More →
Where The Answers. Come From.
Built For The Ones. Who Chase An Alert.
Roles
- Incident Response And Threat HuntingFollow an alert to the actor behind it, with indicators, techniques and leaked access in one place, so a review starts from facts.
- SOC And CTI AnalystGive every alert the context it lacks, track the groups that matter to you and spend less time switching between tabs.
- MSSPs And Service ProvidersRun external threat monitoring for many clients from one platform, with findings you can send to client tools through the API and MCP.
Questions People Ask. About Threat Search.
Ask The TeamQuestions about your own domain? Get in touch.-
It is looking up an indicator, such as an IP, domain, hash or email, and following its links to actors, infrastructure and campaigns in one interface. The aim is context an analyst can act on, not a list of raw data.
-
The product page lists IP, domain, hash, URL, email, CVE and actor name in one search interface. Many indicators can be submitted together by CSV, STIX 2.1 or API for batch enrichment and triage.
-
Incident responders and threat hunters use it. They need answers fast during live incidents, threat hunting campaigns and post-breach forensics, rather than raw data dumps to sift through.
-
Yes. SIEM, SOAR, ticketing and other tools connect through the API and Model Context Protocol (MCP), so enrichment and response can run inside existing workflows. One-click investigation reports can also be generated for analysts.
-
NIST defines indicators of compromise as technical artifacts or observables that suggest an attack is imminent or underway, or that a compromise may have already occurred. They are clues that tell a team where to look.
-
Yes. A list of indicators can be submitted together for bulk enrichment and triage, which helps during an incident or a hunt.
-
For an address: hosting, related domains and past malicious use. For a domain: registration history and related infrastructure. For a file hash: the malware family and linked campaigns. Each result links onward to actors and campaigns so you can keep pivoting.
-
Yes. You can enter an IP, domain, hash, URL, email, CVE or actor name in one search box. Every type opens in the same result format.
-
It shows how an indicator ties to actors, infrastructure and campaigns. You can pivot from one node to the next to follow the links. This helps an analyst see the wider picture and not one lone indicator.
-
No. A link to an actor or campaign is based on evidence and judgment, not certainty. Results also show past activity, so you can tell a one-off from a known pattern.
Keep Reading.
Try A Search. On Your Own Indicators.
A short demo using indicators from a recent alert.