Get global threat intelligence context from RST Cloud
Our mission is to provide cybersecurity professionals with a single, convenient service for consolidating, normalizing, enriching, filtering, and ranking all publicly available cyber threat intelligence from around the world
RST Cloud Engine
Enrichment
Many indicators come with little or no context, which can make it challenging for cybersecurity professionals to determine the appropriate course of action. This can lead to extra work as they try to assess the threat level of indicators and decide whether to action them or further investigate potential threats.
After aggregating indicators of compromise (IoCs) such as IP addresses, domain names, and file hashes from multiple sources, we add valuable context to help cybersecurity professionals more effectively assess the threat level of indicators. Our enrichment process adds the following context to indicators:
- Threat category (e.g. phishing, malware, ransomware)
- Malware family (e.g. Emotet, Trickbot, Ryuk)
- Common Vulnerabilities and Exposures (CVE)
- Threat actors (e.g. APT groups, cybercrime organizations)
We use a combination of external sources and our own proprietary methods to consistently and reliably add this context to indicators. This helps cybersecurity professionals more effectively assess the threat level of indicators and decide on appropriate courses of action quicker.
After IoCs are being aggregated from multiple sources we contextualise them by adding:
Scoring
Cybersecurity professionals often face a deluge of alerts on a daily basis, as hundreds of threats target organizations that rely on the internet for their daily operations. To help prioritize these alerts and focus on the most critical ones first, we use algorithms to rank every indicator with an appropriate score.
Our scoring process helps you identify the indicators that are most likely to pose a threat and should be investigated first. By sorting alerts by score, you can quickly focus on the most relevant and actionable pieces of information, helping you to streamline your workflow and more effectively protect your organization against cyber threats.
RST Threat Feed
RST Threat Feed is a subscription-based service that delivers indicators of compromise collected, aggregated, filtered, and scored from hundreds of threat intelligence sources. Our solution enriches indicators with comprehensive context to accelerate incident prevention and response and enables automation solutions with actionable data.
{
{
"ip": {
"v4": "14.33.133.188", - type | value
"num": "237077948" - value as Integer (comparison can be faster)
},
"fseen": 1569715200, - first seen timestamp
"lseen": 1569801600, - last seen timestamp
"collect": 1571184000, - indicator collection timestamp
"tags": { - tags in order to categorize indicators
"str": [
"shellprobe",
"generic",
"botnet"
],
"codes": [0,11,4] - IDs of the tags
(to be used to minimize memory usage in SIEM)
},
"asn": {
"num": 4766, - An autonomous system number related
WHOIS API
Our WHOIS API provides registration details of a domain name. All of the WHOIS information is parsed and normalised consistently to a JSON format so it can efficiently fit in with your integrations.
{
"status": "registered",
"registered?": "true",
"created_on": "2022-01-01 00:00:00",
"updated_on": "2022-01-01 00:00:00",
"expires_on": "2023-01-01 00:00:00",
"age": 365,
"registrar": "Registrar Name",
"registrant": "Registrant Name",
"nameservers": "ns1.domain.com,ns2.domain.com"
}
Get Free Trial
Choose a product and get your trial account by email
Trusted by partners
Integrations
RST Threat Feed has out-of-the-box integration with many SIEM and TIP solutions. Additionally, you can immediately integrate RST Threat Feed with NGFW solutions to provide your network perimeter with accurate information on current cyberthreats.
Fortigate firewalls can directly be integrated with RST Threat Feed via API. It gives options to block or alert on access to malicious websites or IP addresses. The integration is seamless and requires no extra software to be used to configure the firewalls.
Palo Alto NGFW can directly be integrated with RST Threat Feed via API. It gives options to block or alert on access to malicious websites or IP addresses. The integration is seamless and requires no extra software to be used to configure the firewalls.
RST Thread Feed integrated with IBM Qradar SIEM via RST Downloder agent. This agent automatically downloads all the required data and pushes it to the SIEM via API. There are options to filter indicators through its score and types, malware, tags etc
Palo Alto Cortex XSOAR can directly be integrated with RST Threat Feed via API. It gives an ability to query RST Cloud API directly from any playbook or using the war room commands.
RST Thread Feed integrated with Splunk. The app is published on the official Splunk marketplace and allows to automate downloading and maintenance of the feeds into Splunk.
RST Thread Feed is integrated with Microsoft Sentinel SIEM via a standard STIX/TAXII integration. There are options to filter indicators through its score and types, malware, tags etc
RST Thread Feed is integrated with Elastic SIEM solution via a custom elastic filebeat/agent configuration. There are options to filter indicators through its score and types, malware, tags etc
RST Thread Feed is integrated with MISP via a python script. There are options to filter indicators through its score and types, malware, tags etc
Cisco Firepower can directly be integrated with RST Threat Feed via API. It gives options to block or alert on access to malicious websites or IP addresses. The integration is seamless and requires no extra software to be used to configure the firewalls.
RST Thread Feed is integrated with LogRhythm via RST a standard STIX/TAXII integration. There are options to filter indicators through its score and types, malware, tags etc