# Threat intelligence, *built in and extended*

[Endpoint Central EDR](https://www.manageengine.com/endpoint-detection-and-response/?utm_source=threat-intelligence) arms every detection engine with threat intelligence that is current, verified, and tuned to the threats actually targeting your environment. A built-in threat intelligence database keeps detection current in real time, and third-party threat intelligence integrations extend that coverage with external IoC feeds, all from a single console.

## Yesterday’s indicators can’t catch today’s attack.

Malware is mass-produced, marketed, and sold online — off-the-shelf, not targeted, and cheaper than ever. Add zero-day exploits, malware-as-a-service, dark web marketplaces, and living-off-the-land techniques, and the tactics, techniques, and procedures (TTPs) adversaries rely on shift constantly.

A detection engine is only as sharp as the intelligence behind it. Static rules built on last month’s indicators of compromise (IoCs) miss the campaign that started this morning. Threat intelligence is what keeps detection tuned to the threats that are actually in circulation right now, not the ones that were circulating when the rule was written.

## What is threat intelligence in EDR?

Threat intelligence is structured information about known and emerging threats: indicators of compromise (IoCs) such as malicious IPs, domains, file hashes, and URLs, and indicators of attack (IoAs) that describe attacker behaviour rather than a single artefact. Fed into an EDR platform, threat intelligence gives every detection engine the context to recognise a technique it has not seen on your endpoints before, because it has already been seen somewhere else.

On its own, an IoC list goes stale within days. What makes threat intelligence useful inside EDR is correlation: matching incoming telemetry against current indicators and mapping the result to a known attacker technique, using a shared reference like the MITRE ATT&CK framework, so analysts know not just that something happened, but what it means.

- Indicators of compromise
- Indicators of attack
- TTPs
- Behavioural signals
- Third-party IoC feeds

![The EDR platform the indicators are fed into](https://cdn.manageengine.com/sites/meweb/images/endpoint-detection-and-response/images/edr-core.svg)

- Flags known threats
- Catches attacker behaviour
- Maps to MITRE ATT&CK

## Two ways Endpoint Central EDR keeps detection current.

Being on top of the latest TTPs is critical to surfacing threats before they escalate. Endpoint Central EDR does this in two ways: a threat intelligence database built into the platform, and support for third-party threat intelligence integrations for teams that need to extend coverage further.

### Built-in threat intelligence database

Endpoint Central EDR comes with a threat intelligence database that keeps your defences updated in real time as the threat landscape evolves. Every static and runtime detection engine draws on this database, so newly identified indicators reach your endpoints without waiting on a manual update cycle.

- Behavioural signals, IoAs, IoCs, and TTPs are mapped to the MITRE ATT&CK framework, so a match is presented as a named attacker technique, not a raw alert.
- The database is what lets Endpoint Central EDR tell known threats from unknown ones, and flag anomalous activity that matches neither, before it escalates.

### Third-party threat intelligence integration

For broader coverage, Endpoint Central EDR also supports third-party threat intelligence integrations that ingest external IoC feeds. This lets security teams bring in intelligence specific to their industry, region, or existing threat intelligence vendor relationships, and correlate it against endpoint activity alongside the built-in database, without switching consoles.

- Extend detection beyond the built-in database with feeds your organisation already trusts or is required to consume.
- Correlate externally sourced IoCs with endpoint telemetry in the same workflow used for built-in threat intelligence, so analysts are not juggling separate tools.

| Setting | Value |
|---|---|
| Feed URL | https://misppriv.circl.lu/ |
| MISP API key | •••••••••••••••••••••••• |
| Verify TLS certificate | Enabled |
| Fetch to_ids only | Enabled |
| Attribute type filter | IPv4, IPv6, CIDR, Domain, URL, SHA256 |

### Custom IoA rules

Built-in and third-party intelligence cover the threats already known to the wider world. Custom IoA rules cover the ones specific to you. Define the behaviours, techniques, and conditions that matter most to your environment, using flexible, query-based conditions, and trigger alerts the moment they occur.

| Setting | Value |
|---|---|
| Alert name | Unusual network activity from notepad.exe |
| Run frequency | Last 15 minutes |
| Severity | High |

```text
logtype="edrevents" and class_name contains "Network Activity" and process.file.name contains "notepad.exe"
```

Valid query

Alert when results: High · above 1

### Search threat data in plain language

Endpoint Central EDR retains 30 days of endpoint activity, giving your security team the historical context needed to trace a threat back to its origin. With Zia AI-driven incident search, that history, and the threat intelligence matched against it, can be queried in plain language. No query language to learn, no dashboards to build first.

> Which endpoints matched the MISP feed?

Matched an external IoC in the last 24 hours: 4 endpoints

## Threat intelligence that doesn’t stop at detection.

Most EDR tools tell you a technique matched a known indicator, then leave the rest to you. Endpoint Central EDR is built on the same platform as endpoint management, so when threat intelligence traces an attack back to its root cause, the fix is already within reach.

### Traced back to an unpatched vulnerability?

Endpoint Central identifies the CVE, offers the patch, and helps you deploy it — from the same console that raised the detection.

### Entering through an unauthorised USB device?

Blocked, using the same console. No second tool, no second agent, no handoff to another team.

That is the difference between a standalone threat intelligence feed bolted onto a detection tool, and threat intelligence built into a platform that can also close the gap it just found.

## Built for every security stakeholder.

Whether you run a lean IT team or a dedicated SOC, Endpoint Central EDR’s threat intelligence is built to fit your security structure.

### CISOs and security leaders

![A CISO in a suit, arms crossed](https://cdn.manageengine.com/sites/meweb/images/desktop-central/images/adobe-3.png)

Back your security strategy with a threat intelligence database that is independently validated, and cut vendor complexity by keeping intelligence, detection, and remediation on one platform.

### SOC analysts

![A SOC analyst in a blue shirt, arms crossed](https://cdn.manageengine.com/sites/meweb/images/desktop-central/images/adobe-2.png)

Get every alert enriched with current threat intelligence and mapped to MITRE ATT&CK, and hunt through 30 days of retained activity in plain language with Zia AI — no query syntax required.

### IT administrators

![An IT administrator holding a tablet](https://cdn.manageengine.com/sites/meweb/images/desktop-central/images/adobe-1.png)

When threat intelligence surfaces an attack that traces back to a missing patch or a misconfiguration, remediate it from the same console, without escalating to another team.

## FAQs on threat intelligence

### What is threat intelligence in EDR?

Threat intelligence is data about known and emerging threats, including indicators of compromise (IoCs) like malicious file hashes, IPs, and domains, and indicators of attack (IoAs) that describe attacker behaviour. EDR platforms use threat intelligence to recognise threats that match known TTPs and to flag anomalous activity that does not.