Build a feed in a sentence

Start with one sentence.

• Ransomware activity against UK manufacturing.
• CVEs in the products my top ten clients run.
• Anything mentioning Scattered Spider, ALPHV, or their tooling.

That gets translated into a structured filter against the live entity graph. You see exactly what it picked up, adjust anything it missed or over-matched, and save. Plain English in, working feed out, and the filter stays visible and editable rather than sitting behind the model.

click to expand

AI feed builder

Plain-English feed builder.

Threat actors, malware families, vendors, products, CVEs, sectors, regions or your own named assets. Twenty-one entity types, mixed freely in one feed. The feed only fires on clusters touching what you pinned.

A single client-exposure feed might pin three vendors, two CVEs and the groups known to exploit them. That is one feed rather than three saved searches you have to remember to check.

click to expand

Attached entities

Sidebar showing pinned entities in a feed: actors, malware, vendors, CVEs, with chips you can add or remove.

A feed nobody opens is not intelligence. Send it where the work already happens.

• Email digest, daily or weekly, formatted to be read on a phone before standup
• Slack and Teams, posted to the channel that owns the response
• RSS, for the readers and dashboards your team already runs
• API and webhooks, for anything that needs to happen automatically
• In-platform, switchable from the sidebar

Every feed can use more than one at once, and each feed sets its own frequency. Real time where it matters, once a day where it does not.

Each feed scoped to one client's assets, vendors and exposures. The analyst on the morning shift opens Client A and sees Client A's world, nothing else.

Feeds inherit the same per-customer scoping the rest of the platform uses, so a workflow fired from a client feed can only route to that client's destinations. Nobody sees what they shouldn't, and that holds without anyone having to remember it.

click to expand

Per-client feeds

Sidebar listing custom feeds named after each client, with the active feed showing its scoped cluster list.

Because keyword alerts match strings and this matches entities.

A keyword alert for a vendor name returns every article that mentions it, including forty separate write-ups of the same incident, plus everything using the word incidentally. A feed pinned to that vendor as an entity returns clusters, where every source covering one event has already been grouped into a single record with a timeline, extracted indicators and technique mapping. One thing to read instead of forty.

The difference compounds with scale. Around 900 articles a day across 20,000+ sources become roughly 70 clusters. A keyword tool passes that volume through to you. This does not.

click to expand

Clusters, not articles

Feed view filtered to pinned entities, each row a clustered incident rather than a single article.

• Entity IntelligenceProfile pages for every actor, malware, CVE, and tool
• WorkflowsTriggers, actions, per-customer scoping
• ReportsNotion-style editor with live blocks
• Real-Time ClusteringHow the feed itself is built
• IOCs and ExportsSTIX, MISP, SIEM ingestion
• By industrySector feeds for healthcare, finance, telecoms and more