# Threat Intelligence Operations

URL: https://www.deepinfo.com/solutions/use-cases/threat-intelligence-operations/

## Turn Threat Intelligence Into Daily Work.

Intelligence earns its keep when it changes what analysts do today. Threat Intelligence Operations uses [Cyber Threat Intelligence](https://www.deepinfo.com/platform/cti/) as working material: who targets your sector and with what, what is said about you on the dark web, which of your people appear in which breach, and which news touches your stack.

[Request demo](https://www.deepinfo.com/request-demo/) · [CTI API reference](https://docs.deepinfo.com/reference/cti/)

Intelligence nobody acts on *is just reading.*

Global indicator lists say little about your sector, your stack or your people. A leaked credential or a forum post matters when you know whose it is, which asset it touches and which actor might use it.

### All Inputs Feed One Set of Records.

| Input | What analysts get | Capability |
| --- | --- | --- |
| Threat actors | Profiles with origin countries, activity on leak sites, forums and markets, targeted regions, industries and organizations, and the CVEs and tools each actor uses | [Threat Actor Intelligence](https://www.deepinfo.com/platform/cti/threat-actor-intelligence/) |
| Dark web, on demand | Searches by free text or by indicator type, narrowed by source, date and hackishness | [Dark Web Search](https://www.deepinfo.com/platform/cti/dark-web-search/) |
| Dark web, continuous | Mentions of your domains, brands and people on forums, markets, paste sites, chats and leak sites | [Dark Web Mentions Monitoring](https://www.deepinfo.com/platform/cti/dark-web-mentions-monitoring/) |
| Breaches | Breaches that include your addresses, with dates, exposed data types and affected account counts | [Data Breach Index](https://www.deepinfo.com/platform/cti/data-breach-index/) |
| News | Curated cybersecurity news, linked to the CVEs, threat actors and issue types it concerns | [Cybersecurity News](https://www.deepinfo.com/platform/cti/cybersecurity-news/) |
| Indicators | Lookalike domains, dark web indicators and the CVEs actors use, scoped for your detection stack | [IOC Feeds](https://www.deepinfo.com/platform/cti/ioc-feeds/) |

### Run These Steps Each Working Day.

1. **Triage**

   Start the day with what is new since yesterday: breaches that include your addresses, leaked credentials and dark web mentions.
2. **Enrich**

   Tie each finding to what it touches: the account, the device, the asset, the actor profile or the CVE.
3. **Hand off**

   Send resets, reviews and takedowns to the teams that own them, and close each record in a recorded state.
4. **Report**

   Summarize for leadership with the CTI Email Breach Summary report, on demand or on a daily, weekly or monthly schedule.

### Intelligence That Arrives Where Analysts Work.

Notification rules send email on the events your team cares about, including new email breaches and new fraudulent domains, instantly or as an hourly, daily, weekly or monthly digest.

Everything else is an API call with the same `apikey` header. Breaches, credentials, devices, threat actors and news all have list or search endpoints, and the credential records add export and bulk state actions for the tools your SOC already runs.

[Integrations](https://www.deepinfo.com/integrations/)

Most used CVEs:

```bash
# The CVEs that appear most often in threat actor profiles
curl "https://api.deepinfo.com/v1/cti/threat-actors/stats/most-used-cves" \
  -H "apikey: YOUR_API_KEY"
```

Latest breaches:

```bash
# The most recent breaches that include your addresses
curl "https://api.deepinfo.com/v1/cti/email-breaches/breaches/latest" \
  -H "apikey: YOUR_API_KEY"
```

Alert rule:

```bash
# Email the CTI team when a new email breach is found
curl -X POST "https://api.deepinfo.com/v1/platform/notification-rules" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "New email breach",
    "scope": "new_email_breach_detected",
    "frequency": "instant",
    "members": ["USER_ID"]
  }'
```

### See Intelligence Put to Work.

- [A national telecom operator](https://www.deepinfo.com/customers/telecommunications-national-operator/) (Customer story): Threat actor intelligence scoped to the groups that target telecom operators.
- [Threat Hunting](https://www.deepinfo.com/solutions/use-cases/threat-hunting/) (Use case): Test hypotheses against the index and the actor profiles.
- [Dark Web Monitoring](https://www.deepinfo.com/solutions/use-cases/dark-web-monitoring/) (Use case): Your domains, brands and people on forums, markets and leak sites.

### Use This Data in Your Tools

Analysts can pivot through these records from their own tools: what else sits on an IP address, what a domain resolved to before, and who registered it.

- [Reverse IP API](https://www.deepinfo.com/data-api/apis/reverse-ip/)
- [DNS History API](https://www.deepinfo.com/data-api/apis/dns-history/)
- [WHOIS History API](https://www.deepinfo.com/data-api/apis/whois-history/)
- [Reverse WHOIS Email API](https://www.deepinfo.com/data-api/apis/reverse-whois-email/)

### Questions About Threat Intelligence Operations

**How is this different from a threat feed?**

A feed is a list of indicators. Here each finding comes as a record with context around it: whose account, which device, which actor, which CVE, and a state your team sets when it is handled.

**Which SIEM, SOAR and ticketing tools does it connect to?**

Connection options are listed on the [integrations](https://www.deepinfo.com/integrations/) page. Beyond those, the CTI API and its exports work with any tool that can make an HTTP request or read CSV or JSON.

**Can we scope actor intelligence to our sector?**

Yes. Profiles list the regions, countries, industries and organizations each actor targets, so filtering by your country and industry narrows the list to the actors worth your attention.

**Where does the news come from?**

From third-party security publishers. Each article keeps its source and a link to the original.

**Is the news in the Deepinfo Platform or only in the API?**

Both. The platform has a news list with search and filters, and the API exposes the same articles through search and detail endpoints.

### Make Intelligence Part of the Shift.

Book a demo and see the actor profiles, dark web coverage and breach records for your sector and domains.

[Request demo](https://www.deepinfo.com/request-demo/)