Every cyberattack leaves traces before it strikes. Threat intelligence is the discipline of collecting, analyzing, and acting on those traces — turning raw signals into actionable insights.
Knowledge that helps organizations stop attacks before they cause damage.
Cyber threat intelligence (CTI) is information about existing or emerging threats that helps security and network teams make faster, better-informed decisions. It answers the fundamental questions: Who is attacking us? How are they doing it? What are they targeting? What can we do to stop them?
Understand how threat intelligence integrates at the DNS layer to strengthen everyday network defenses.
Learn how IoCs and threat feeds combine into layered controls that stop attacks earlier in the kill chain.
Turn raw indicators into prioritized, high-confidence detections and faster incident investigations.
Modern cyberattacks are not random. Threat actors follow patterns, reuse infrastructure, and exploit the same vulnerabilities across multiple targets. Without threat intelligence, you react. With it, you anticipate — and block threats before they reach your endpoints.
Threat intelligence continuously collects data from multiple sources, processes it into structured information, and distributes it to enforcement points across your network — all in real time.
An IoC is forensic evidence suggesting a system may have been breached or is under attack. IoCs are the building blocks of technical threat intelligence — the specific, actionable signals that enforcement tools use to detect and block threats.
Malicious domain names used for phishing, malware distribution, or C2 communication. Every device querying a malicious domain generates a detectable signal at the DNS layer.
IP addresses associated with known attacker infrastructure, C2 servers, botnet nodes, or scanning hosts. Blocking these prevents communication with attacker-controlled systems.
Specific URLs known to deliver malware, host phishing pages, or redirect victims to exploit kits.
Why IoCs matter at the DNS layer: DNS is queried by every device before it communicates with anything on the internet. This makes DNS the single most comprehensive visibility point for IoC detection — every malicious domain lookup, C2 callback, and phishing attempt generates a DNS query that can be inspected, flagged, and blocked in real time.
A threat feed is a continuous, real-time stream of IoCs sourced from vendors, research organizations, government agencies, or industry sharing groups — the operational backbone of any threat intelligence program.
Why multiple feeds matter: No single feed sees everything. Integrating multiple feeds and cross-validating indicators significantly reduces blind spots and increases confidence.
DNS threat intelligence applies threat intelligence at the DNS layer, using IoCs, threat feeds, and behavioral analysis to detect, block, and respond to threats the moment a malicious domain is queried.
Applied at the DNS layer, threat intelligence delivers measurable improvements across prevention, response, visibility, and compliance.
Broad feed support to eliminate blind spots and cross-validate indicators.
Enforcement decisions made without manual review or ticket queues.
Enforcement at the earliest point in the attack chain, before any connection.
Beyond static blocklists — catch DGA, tunneling, and enumeration by behavior.
Isolation at DNS and DHCP levels for tamper-resistant containment.
Trusted whitelists so legitimate business domains resolve normally.
Investigation views and exportable reports for every flagged IoC.
Simultaneous enforcement across both layers for complete containment.
DDI Central brings together DNS, DHCP, and IP address management in a single platform, applying threat intelligence natively across all three layers for unified containment.
DDI Central ships with ManageEngine CloudDNS as its default feed and lets administrators broaden coverage by onboarding threat data from industry-leading vendors like IBM X-Force, AlienVault OTX, Kaspersky, Cyware, PulseDive, and Sectrio, alongside any custom STIX/TAXII source — all configured from a single console.
Every IoC is assigned a vendor-scored confidence rating, and indicators that cross your configured threshold are automatically enforced across all DNS servers via the DNS Firewall blocklist — no manual rule-writing or deployment required.
Administrators get a unified real-time threat intelligence dashboard that surfaces all DNS-layer activity in one place — total threats, threats per hour, top affected hosts, categories, record type abuse, and confidence-score distribution.
Going beyond static blocklists, DDI Central's anomaly detection engine, powered by Zoho's Zia AI alongside a built-in rule library, identifies threats by behavior rather than known signatures — catching DGA activity, DNS tunneling, subdomain enumeration, and DHCP starvation before any feed has classified them.
The moment DDI Central observes continuous queries from an internal device to domains in the active threat feed, it triggers automatic isolation through DNS Detection and Response (DDR) — enforcing containment via ACL-based DNS blocking, client subnet isolation, DHCP host reservation, and MAC address filtering.
Aggressive threat feeds can sometimes flag legitimate business domains. Administrators retain full override control by marking specific domains as whitelisted trusted domains, ensuring they resolve normally even if they appear in an active blocklist.
For every flagged IoC, DDI Central generates detailed filterable threat reports, covering hit counts, confidence score history over time, top affected hosts, and threat category breakdowns — exportable as PDF or CSV and retained for up to three years for GDPR, HIPAA, and PCI-DSS audit requirements.
Threat intelligence and threat detection are complementary but distinct disciplines. Threat intelligence is the knowledge layer — it collects, analyses, and distributes information about known and emerging threats, such as malicious domains, attacker TTPs, and IoC confidence scores. Threat detection is the action layer — it monitors network activity in real time and triggers alerts or automated responses when suspicious behavior is observed. In practice, threat detection is only as effective as the intelligence feeding it.
Structured Threat Information Expression (STIX) is a standardized language for describing cyberthreat intelligence — including IoCs, attacker tactics, threat actors, and campaigns — in a machine-readable format. Trusted Automated eXchange of Indicator Information (TAXII) is the transport protocol that delivers STIX-formatted intelligence between threat feed servers and security tools. Together, STIX/TAXII enable organizations to consume threat intelligence from multiple vendors simultaneously without manual processing.
Traditional threat intelligence relies on known indicators. Zero-day attacks, by definition, involve threats that have not yet been cataloged by any feed. This is where behavioral anomaly detection closes the gap. AI-powered engines, like the one built into ManageEngine DDI Central, analyze DNS query patterns, DHCP behavior, and traffic characteristics to identify malicious activity based on how it behaves — including DGA activity, DNS tunneling, and newly registered domains with suspicious profiles, even before any feed has flagged them.
A confidence score is a numerical rating assigned to each IoC by a threat intelligence vendor, reflecting how certain the system is that a given domain, IP, or URL is genuinely malicious. Scores typically range from 0 to 100 — the higher the score, the greater the certainty. In DDI Central, indicators scoring 50 and above are automatically added to the DNS Firewall blocklist, while critical threats scoring 90 and above are isolated immediately.
A traditional network firewall operates at the IP and port level. DNS threat intelligence operates earlier in the attack chain — at the domain resolution layer — blocking malicious domains before any network connection is even established. This means DNS threat intelligence can stop threats a firewall would miss entirely, like newly registered phishing domains, algorithmically generated C2 domains, and DNS tunneling. Used together, they form a complementary, layered defense.
Experience DNS-native threat intelligence, AI anomaly detection, and unified DDI in one platform.