Partner Integrations


Threat Intelligence Platforms (TIP)

Anomali Logo

Anomali | ThreatStream

Type: TIP

Anomali ThreatStream combines threat intelligence, big data management, and machine learning to provide security teams with tools and insights for rapid threat detection, analysis, and response. 

The Anomali Threat Platform connects Flashpoint’s finished intelligence with existing security solutions so Anomali customers can gain visibility into industry-specific threats and threat actors.

Supported Datasets:  Alerting, Compromised Credentials, Intelligence Reports, Technical Indicators, Vulnerabilities

Silobreaker Logo

Silobreaker

Type: TIP

Silobreaker aggregates and analyzes data from millions of sources across 17 languages to provide actionable insights for cyber threat intelligence, geopolitical risk assessment, and strategic decision-making.

Correlating Flashpoint’s data with Silobreaker’s surface web sources and powerful analytical tools gives customers the visibility and context needed to assess trends and efficiently combat threats to their operations.

Supported Datasets: Card Fraud, Communities, Compromised Credentials, Intelligence Reports, Marketplaces

ThreatConnect

ThreatConnect

Type: TIP

ThreatConnect enables organizations to aggregate, analyze, and operationalize threat data for enhanced security and risk management. 

Flashpoint complements ThreatConnect with intelligence reports and Indicators of Compromise (IoCs) so customers can associate incidents with indicators and gain helpful context like MITRE ATT&CK tags and scoring.

Supported Datasets:  Intelligence Reports, Technical Indicators, Vulnerabilities

ThreatQuotient Logo

ThreatQuotient | ThreatQ

Type: TIP

ThreatQ combines, normalizes, and contextualizes threat data from external and internal sources into a Threat library used across the organization.

The ThreatQ and Flashpoint integration offers access to an extensive range of datasets to provide a “state of the threat” landscape to assist security personnel in developing and prioritizing intelligence on emerging threats.

Supported Datasets: Alerting, Card Fraud, Communities, Compromised Credentials, Intelligence Reports, Marketplaces, Media, Technical Indicators, Vulnerabilities

EclecticIQ

Type: TIP

With EclecticIQ and Flashpoint, teams use a set of workflows in a collaborative workplace to focus, triage, analyze, collaborate, and act decisively on the right course of action.

Supported Datasets: Communities, Intelligence Reports, Marketplaces, Technical Indicators

Cyware Logo

Cyware CTIX

Type: TIP

Cyware CTIX provides a comprehensive platform for threat intelligence management, security orchestration and automation, and collaborative threat response, enabling organizations to build cyber fusion centers and enhance their overall security posture.

The Cyware CTIX Flashpoint integration provides critical external threat insight for security teams of all sizes and maturities in a centralized location to more quickly and efficiently identify and respond to emerging threats targeting their organizations.

Supported Datasets: Intelligence Reports, Technical Indicators, Vulnerabilities

Analyst1

Type: TIP

Analyst1 is a threat intelligence platform designed to enhance cybersecurity by streamlining the processes of threat detection, analysis, and response.

Analysts can leverage the Analyst1 and Flashpoint integration to access comprehensive threat intelligence, query indicators across multiple datasets, perform enhanced threat analysis and hunting, and gain real-time context for faster triage and more informed decision-making within their existing workflows.

Supported Datasets: Intelligence Reports

Security Orchestration, Automation, and Response (SOAR)

XSOAR Logo

Cortex XSOAR

Type: SOAR

Cortex XSOAR unifies case management, automation, real-time collaboration, and threat intelligence management to help security teams improve efficiency and standardize incident response processes. 

XSOAR users can access and integrate Flashpoint’s data and finished intelligence with their existing workflows and automated tools to enhance their threat intelligence capabilities and streamline incident response processes.

Supported Datasets: Alerting, Communities, Compromised Credentials, Intelligence Reports, Marketplaces, Technical Indicators, Vulnerabilities

ServiceNow Logo

ServiceNow

Type: SOAR

ServiceNow is a cloud-based workflow automation platform that enhances operational efficiencies across enterprise organizations by streamlining and automating various business functions. 

ServiceNow users can access and integrate Flashpoint’s data and finished intelligence with their existing workflows and automated tools to enhance their threat intelligence capabilities and streamline incident response processes.

Supported Datasets: Alerting, Communities, Compromised Credentials, Intelligence Reports, Marketplaces, Technical Indicators, Vulnerabilities

Splunk Phantom Logo

Splunk | Phantom

Type: SOAR

Splunk Phantom integrates with over 300 security tools to automate repetitive tasks, streamline incident response workflows, and enable security teams to investigate and remediate threats more quickly and efficiently.

The Flashpoint Splunk Phantom integration facilitates easy access to Flashpoint data and intelligence with associated context specifically for Splunk Phantom users. Flashpoint datasets enrich internal data, assisting security teams to automate tasks, orchestrate workflows, and support a broad range of SOC functions.

Supported Datasets: Alerting, Communities, Compromised Credentials, Intelligence Reports, Marketplaces, Technical Indicators

Security Information and Event Management (SIEM)

QRadar Logo

IBM QRadar

Type: SIEM

IBM QRadar collects and analyzes log data, and network flows across an organization’s IT infrastructure to detect, prioritize, and respond to security threats in real time.

With the ‘Flashpoint for QRadar’ app, QRadar customers have visibility into illicit online communities to correlate information related to their infrastructure and can be notified when indicators from internal log data match with Flashpoint intelligence.

Supported Datasets: Intelligence Reports, Technical Indicators

Splunk Logo

Splunk

Type: SIEM

Splunk is a data platform that enables organizations to collect, search, analyze, and visualize machine-generated data. 

With the Flashpoint Splunk app and add-on, Splunk users are notified when internal log data indicators correspond with Flashpoint intelligence, enabling them to prioritize their response.

Supported Datasets: Alerting, Communities, Compromised Credentials, Intelligence Reports, Marketplaces, Technical Indicators, Vulnerabilities

Analysis and Investigations

Maltego Logo

Maltego

Type: Analysis

Maltego is an investigation platform that accelerates complex cyber investigations by enabling users to gather, analyze, and visualize data from diverse sources to uncover relationships and patterns between entities like domains, IP addresses, and social media profiles.

With Flashpoint’s Maltego Transforms, investigators can incorporate Flashpoint data into Maltego workflows to obtain actionable intelligence, mitigate risk, and combat threats and adversaries.

Supported Datasets: Alerting, Communities, Compromised Credentials, Intelligence Reports, Marketplaces, Technical Indicators

Polarity Logo

Polarity

Type: Analysis

Polarity is a free-floating overlay platform that automatically searches unlimited sources in parallel to augment data and information from existing applications, accelerating analysis by enriching every tool and workflow.

Polarity users can leverage the Flashpoint integration for threat analysis, threat hunting, and malware analysis by correlating information from Flashpoint. 

Polarity users can leverage Flashpoint data for real-time context and insights on indicators like IP addresses, domains, file hashes, and CVEs within their existing workflows, enabling faster triage and more informed decision-making.

Supported Datasets: Intelligence Reports, Technical Indicators, Vulnerabilities

Vertex Logo

Vertex Project | Synapse Enterprise

Type: Analysis

Synapse is a comprehensive central intelligence and analysis system that supports analyst teams throughout the intelligence lifecycle.

This integration merges Flashpoint’s threat intelligence with Vertex’s data analytics platform so users can gain deeper insights into threats.

Supported Datasets: Communities, Marketplaces, Technical Indicators

Ontic

Type: Investigation

Ontic is a protective intelligence software provider that helps organizations identify, investigate, assess, and manage physical security threats.

With the integration of Flashpoint Alerting, Ontic customers can augment their data to get a full picture of potential physical and cyber threats.

Supported Datasets: Alerting

Blockchain Intelligence

TRM Logo

TRM Labs

Type: Blockchain Intelligence

TRM Labs provides blockchain intelligence to help government agencies investigate and build cases for digital asset fraud and financial crime.

Investigators using TRM Forensics can access real-time and historical information from Flashpoint’s illicit communities and marketplaces.

Customers with access to Flashpoint Ignite can seamlessly pivot into Ignite directly from Forensics, unlocking deeper insights and investigative pathways.

Supported Datasets: Communities, Marketplaces

Product Integrations


Slack Integration Logo

Slack

Flashpoint customers can receive alerts from the Ignite platform within Slack for rapid visibility and streamlined workflows.

MISP

Flashpoint’s Technical Indicators API provides MISP endpoints to support integrations to automate information sharing.

STIX TAXII

Flashpoint’s Technical Indicators API provides STIX/TAXII 2.1 endpoints to support integrations to automate information sharing.

Dataset Descriptions


Alerting: Email alerts that match a user’s area of concern such as leaked assets, organizational risks, or industry-related threats.

Card Fraud: Visibility into exposed card data within illicit card shops and threat actor communities provides insight into cybercriminal tactics so organizations can detect, prevent, and respond to fraud-related threats.

Communities: Discussions from illicit threat actor communities operating in chat services, forums, blogs, and social media networks provide early warning signals to help organizations stay ahead of attacks.

Compromised Credentials: Database of over 48 billion stolen and leaked credentials from open sources, illicit communities, marketplaces, and infostealer malware logs.

Marketplaces: Access to deep and dark web marketplaces helps users understand cyber threats, assess exposure, and potentially recover stolen data.

Intelligence Reports: Finished intelligence reports written by seasoned analysts provide expert insight into a broad spectrum of current and emerging threats, including fraud, malware, ransomware, violent extremism, and physical threats.

Technical Indicators: Indicators of compromise (IoCs) and technical data across Flashpoint datasets and those included in finished intelligence reports.

Vulnerabilities: Access to Flashpoint’s extensive vulnerability data enables effective prioritization to prevent or mitigate exposure.

See Flashpoint in Action