Request demo

Threat Intelligence Operations

Turn Threat Intelligence Into Daily Work.

Intelligence earns its keep when it changes what analysts do today. Threat Intelligence Operations uses Cyber Threat Intelligence as working material: who targets your sector and with what, what is said about you on the dark web, which of your people appear in which breach, and which news touches your stack.

Request demoCTI API reference

From Threat actors Dark web, on demand Dark web, continuous Breaches News Indicators

accountj.@acme.example

  1. In a new breach

    new since yesterday · VIP · new_email_breach_detected

  2. For sale

    2026-09-12 · dark web: “… accounts on acme.example for sale …”

  3. Reset

    identity team: password reset · sessions revoked

  4. In the daily summary

    CTI Email Breach Summary

state recorded

Intelligence nobody acts on is just reading.

Global indicator lists say little about your sector, your stack or your people. A leaked credential or a forum post matters when you know whose it is, which asset it touches and which actor might use it.

All Inputs Feed One Set of Records.

InputWhat analysts getCapability
Threat actorsProfiles with origin countries, activity on leak sites, forums and markets, targeted regions, industries and organizations, and the CVEs and tools each actor usesThreat Actor Intelligence
Dark web, on demandSearches by free text or by indicator type, narrowed by source, date and hackishnessDark Web Search
Dark web, continuousMentions of your domains, brands and people on forums, markets, paste sites, chats and leak sitesDark Web Mentions Monitoring
BreachesBreaches that include your addresses, with dates, exposed data types and affected account countsData Breach Index
NewsCurated cybersecurity news, linked to the CVEs, threat actors and issue types it concernsCybersecurity News
IndicatorsLookalike domains, dark web indicators and the CVEs actors use, scoped for your detection stackIOC Feeds

Run These Steps Each Working Day.

  1. 01

    Triage

    Start the day with what is new since yesterday: breaches that include your addresses, leaked credentials and dark web mentions.

  2. 02

    Enrich

    Tie each finding to what it touches: the account, the device, the asset, the actor profile or the CVE.

  3. 03

    Hand off

    Send resets, reviews and takedowns to the teams that own them, and close each record in a recorded state.

  4. 04

    Report

    Summarize for leadership with the CTI Email Breach Summary report, on demand or on a daily, weekly or monthly schedule.

Intelligence That Arrives Where Analysts Work.

Notification rules send email on the events your team cares about, including new email breaches and new fraudulent domains, instantly or as an hourly, daily, weekly or monthly digest.

Everything else is an API call with the same apikey header. Breaches, credentials, devices, threat actors and news all have list or search endpoints, and the credential records add export and bulk state actions for the tools your SOC already runs.

Integrations
# The CVEs that appear most often in threat actor profiles
curl "https://api.deepinfo.com/v1/cti/threat-actors/stats/most-used-cves" \
  -H "apikey: YOUR_API_KEY"

See Intelligence Put to Work.

Customer story A national telecom operator Threat actor intelligence scoped to the groups that target telecom operators. Read Use case Threat Hunting Test hypotheses against the index and the actor profiles. Read Use case Dark Web Monitoring Your domains, brands and people on forums, markets and leak sites. Read

Use This Data in Your Tools

Analysts can pivot through these records from their own tools: what else sits on an IP address, what a domain resolved to before, and who registered it.

Questions About Threat Intelligence Operations

How is this different from a threat feed?

A feed is a list of indicators. Here each finding comes as a record with context around it: whose account, which device, which actor, which CVE, and a state your team sets when it is handled.

Which SIEM, SOAR and ticketing tools does it connect to?

Connection options are listed on the integrations page. Beyond those, the CTI API and its exports work with any tool that can make an HTTP request or read CSV or JSON.

Can we scope actor intelligence to our sector?

Yes. Profiles list the regions, countries, industries and organizations each actor targets, so filtering by your country and industry narrows the list to the actors worth your attention.

Where does the news come from?

From third-party security publishers. Each article keeps its source and a link to the original.

Is the news in the Deepinfo Platform or only in the API?

Both. The platform has a news list with search and filters, and the API exposes the same articles through search and detail endpoints.

Make Intelligence Part of the Shift.

Book a demo and see the actor profiles, dark web coverage and breach records for your sector and domains.

Request demo