Traced back to an unpatched vulnerability?
Endpoint Central identifies the CVE, offers the patch, and helps you deploy it — from the same console that raised the detection.
Endpoint Central EDR > Threat IntelligenceThreat intelligence,
Threat intelligence,
built in and extended
Endpoint Central EDR arms every detection engine with threat intelligence that is current, verified, and tuned to the threats actually targeting your environment. A built-in threat intelligence database keeps detection current in real time, and third-party threat intelligence integrations extend that coverage with external IoC feeds, all from a single console.
Ask Ziaor match an indicatorLive
Which endpoints matched the MISP feed?
4 indicators4 devices1 flagged
7f3a…e19cSHA256Finance-WS-0712m ago185.243.x.xIPv4Joe’s Win 111h agovendor-portal.ruDomainBobby’s Win 104h agob21c…4a7fSHA256Finance-WS-029h agoMITRE ATT&CKT1059.001 · PowerShell
Yesterday’s indicators
can’t catch today’s attack.
Malware is mass-produced, marketed, and sold online — off-the-shelf, not targeted, and cheaper than ever. Add zero-day exploits, malware-as-a-service, dark web marketplaces, and living-off-the-land techniques, and the tactics, techniques, and procedures (TTPs) adversaries rely on shift constantly.
A detection engine is only as sharp as the intelligence behind it. Static rules built on last month’s indicators of compromise (IoCs) miss the campaign that started this morning. Threat intelligence is what keeps detection tuned to the threats that are actually in circulation right now, not the ones that were circulating when the rule was written.
What is threat intelligence in EDR?
Threat intelligence is structured information about known and emerging threats: indicators of compromise (IoCs) such as malicious IPs, domains, file hashes, and URLs, and indicators of attack (IoAs) that describe attacker behaviour rather than a single artefact. Fed into an EDR platform, threat intelligence gives every detection engine the context to recognise a technique it has not seen on your endpoints before, because it has already been seen somewhere else.
On its own, an IoC list goes stale within days. What makes threat intelligence useful inside EDR is correlation: matching incoming telemetry against current indicators and mapping the result to a known attacker technique, using a shared reference like the MITRE ATT&CK framework, so analysts know not just that something happened, but what it means.
- Indicators of compromise
- Indicators of attack
- TTPs
- Behavioural signals
- Third-party IoC feeds
- Flags known threats
- Catches attacker behaviour
- Maps to MITRE ATT&CK
Two ways Endpoint Central EDR keeps detection current.
Being on top of the latest TTPs is critical to surfacing threats before they escalate. Endpoint Central EDR does this in two ways: a threat intelligence database built into the platform, and support for third-party threat intelligence integrations for teams that need to extend coverage further.
Built-in threat intelligence database
Endpoint Central EDR comes with a threat intelligence database that keeps your defences updated in real time as the threat landscape evolves. Every static and runtime detection engine draws on this database, so newly identified indicators reach your endpoints without waiting on a manual update cycle.
- Behavioural signals, IoAs, IoCs, and TTPs are mapped to the MITRE ATT&CK framework, so a match is presented as a named attacker technique, not a raw alert.
- The database is what lets Endpoint Central EDR tell known threats from unknown ones, and flag anomalous activity that matches neither, before it escalates.
Third-party threat intelligence integration
For broader coverage, Endpoint Central EDR also supports third-party threat intelligence integrations that ingest external IoC feeds. This lets security teams bring in intelligence specific to their industry, region, or existing threat intelligence vendor relationships, and correlate it against endpoint activity alongside the built-in database, without switching consoles.
- Extend detection beyond the built-in database with feeds your organisation already trusts or is required to consume.
- Correlate externally sourced IoCs with endpoint telemetry in the same workflow used for built-in threat intelligence, so analysts are not juggling separate tools.
- 1Connection
- 2Behaviour & schedule
- 3Review
Feed URL *https://misppriv.circl.lu/
MISP API key *••••••••••••••••••••••••
Attribute type filter
ProceedCancel
Custom IoA rules
Built-in and third-party intelligence cover the threats already known to the wider world. Custom IoA rules cover the ones specific to you. Define the behaviours, techniques, and conditions that matter most to your environment, using flexible, query-based conditions, and trigger alerts the moment they occur.
- Alert name
- Unusual network activity from notepad.exe
- Run frequency
- Last 15 minutes
- Severity
logtype="edrevents"andclass_namecontains"Network Activity"andprocess.file.namecontains"notepad.exe"Valid queryAlert when resultsHigh · above 1
Search threat data in plain language
Endpoint Central EDR retains 30 days of endpoint activity, giving your security team the historical context needed to trace a threat back to its origin. With Zia AI-driven incident search, that history, and the threat intelligence matched against it, can be queried in plain language. No query language to learn, no dashboards to build first.
Which endpoints matched the MISP feed?
matched an external IoC in the last 24 hours4 endpoints
Threat intelligence that doesn’t stop at detection.
Most EDR tools tell you a technique matched a known indicator, then leave the rest to you. Endpoint Central EDR is built on the same platform as endpoint management, so when threat intelligence traces an attack back to its root cause, the fix is already within reach.
Entering through an unauthorised USB device?
Blocked, using the same console. No second tool, no second agent, no handoff to another team.
That is the difference between a standalone threat intelligence feed bolted onto a detection tool, and threat intelligence built into a platform that can also close the gap it just found.
Built for every security stakeholder.
Whether you run a lean IT team or a dedicated SOC, Endpoint Central EDR’s threat intelligence is built to fit your security structure.
CISOs and security leaders
Back your security strategy with a threat intelligence database that is independently validated, and cut vendor complexity by keeping intelligence, detection, and remediation on one platform.
SOC analysts
Get every alert enriched with current threat intelligence and mapped to MITRE ATT&CK, and hunt through 30 days of retained activity in plain language with Zia AI — no query syntax required.
IT administrators
When threat intelligence surfaces an attack that traces back to a missing patch or a misconfiguration, remediate it from the same console, without escalating to another team.
Stay current with every attacker move.
Endpoint Central EDR keeps detection current with a built-in threat intelligence database, extended by third-party IoC feed integrations, all managed from one console.
FAQs on threat intelligence
Threat intelligence is data about known and emerging threats, including indicators of compromise (IoCs) like malicious file hashes, IPs, and domains, and indicators of attack (IoAs) that describe attacker behaviour. EDR platforms use threat intelligence to recognise threats that match known TTPs and to flag anomalous activity that does not.
Yes. In addition to its built-in threat intelligence database, Endpoint Central EDR supports third-party threat intelligence integrations that ingest external IoC feeds, extending detection coverage beyond what is built in.
The built-in threat intelligence database updates in real time as the threat landscape evolves, so detection engines are working against current indicators rather than a periodic manual update.
An indicator of compromise (IoC) is an artefact tied to a specific threat, such as a file hash or a malicious IP address. An indicator of attack (IoA) describes attacker behaviour or technique, which can catch a threat even when the specific artefact has never been seen before. Endpoint Central EDR uses both, mapped to the MITRE ATT&CK framework.
Yes. Custom IoA rules let you define the specific behaviours, techniques, and conditions relevant to your environment, using flexible, query-based conditions, and trigger alerts when they occur.
No. Threat intelligence, along with the rest of Endpoint Central EDR, runs on the existing Endpoint Central agent. No additional agent deployment is required.
No. EDR, including its threat intelligence capabilities, is available as a paid add-on for all Endpoint Central editions and is not part of the Security Edition license.