By use case
For AI SOC agents
Agents act in seconds — and amplify every bad input they are handed. Intelligence they can verify, not just consume.
Agent-ready — machine-priced, machine-readable, machine-verifiable.
The problem
An agent can work out that Void Blizzard, UAC-0190 and Laundry Bear are one actor. It shouldn’t have to, every single time.
Microsoft named it in May 2025, working with Dutch intelligence. CERT-UA and Proofpoint each had it under a different name first. A capable agent can cross-reference enough reports to reconstruct that they’re the same group — but that’s minutes of searching per actor, repeated on every session, before the real question even gets asked. A human analyst hits this once and remembers it; an agent starts from zero every time, and the tokens spent reconciling names are tokens not spent on the task. The same applies to a stale indicator, an unscored feed, or an answer with no source behind it.
Autonomy raises the cost of doing this from scratch, at scale. What an agent needs is not more data to search through but an answer already resolved.
Why not just search the web?
Web search isn’t a CTI strategy
A capable agent can search the open web for almost anything. For threat intelligence specifically, that runs into six problems at once — not eventually, on the first query.
Trust
A poisoned result or a popular-but-generic write-up ranks the same as a specific, verified one. The alternative isn’t a better search — it’s a response backed by source references to actual, scored threat reports.
from Report Hub’s verified reports, cited by CTI AssistantCurrency
The top result may describe a stealer variant six versions old. Without a continuously updated corpus, an agent can’t tell current from historical.
from RST Threat FeedHallucination
Even grounded models fabricate — an invented CVE, an actor stitched together from adjacent reports. Every claim needs a source it can cite, not a summary to trust.
from CTI Assistant’s source-referenced answersCoverage
Honeypot captures, C2 tracking, resolved aliases, partner telemetry — none of it was posted publicly for a search engine to index in the first place.
from first-party sensors and data partners (e.g. Netlas’ internet-wide scanning)Stopping early
A known-good verdict in one call ends the investigation before it starts, instead of a dozen searches slowly concluding what was already known.
from RST Noise ControlToken cost
Re-deriving the same research every session is not free — a deep-research task runs $2–7 and dozens of searches, repeated on every query.
from what running CTI on an agent actually costsWhat answers it
Not one product. One intelligence layer.
No single product answers “what is this, and how do I mitigate it” end to end. The layer does — each product proving a different part of trust, so an agent working through any one of them inherits the guarantees of all the others.
Enrichment at investigation time
When the verdict isn’t in the feed yet
Half of what an agent meets during an incident has never been scored by anyone — a domain registered this morning, an IP nobody has reported. The agent still has to reason about it. The RST Enrichment API gives it observable facts to reason from, every one of them callable as a tool over MCP.
Registration reality
Registrar, creation and expiry dates, nameservers, contact structure.
A domain created three days ago and one registered in 2009 deserve opposite default assumptions — age alone is often the strongest single signal an agent has.
Certificate and its neighbours
Issuer, validity window and the full SAN list for an IP:port.
The SAN list is the pivot: one certificate routinely names every sibling host in the same operation, turning a single IP into the whole cluster.
The kit’s fingerprint
Favicon metadata and the image itself for any target.
Operators re-deploy kits without changing the icon. A favicon match across otherwise unrelated domains is one of the cheapest ways to find the rest of a campaign.
What the page actually serves
Raw body markup and the JavaScript extracted from it.
This is where a credential harvester gives itself away — the form target, the exfil endpoint, the obfuscated loader — none of which is visible from the URL.
Visual confirmation
A PNG of the live page, captured as first, full or last.
last follows the redirect chain to where a victim actually lands — the brand being impersonated is usually invisible at the first hop.
Is it really a C2?
Cobalt Strike beacon scan against a suspected IP:port or URL.
Turns “this IP looks suspicious” into a configuration pulled off the listener itself — evidence an agent can attach to a finding rather than a hunch it has to hedge.
All of it is one MCP surface. The same server also exposes ioc_lookup for a scored verdict, noise_lookup and noise_batch_lookup to discard known-good before spending a single enrichment call, report_get_stix for the reporting behind a finding, and threat_object_get for the actor or malware profile it belongs to. An agent chains them in one session — and every answer it produces can be traced back to the call that produced it.
One agent, or many
Every SOC role needs different intelligence
An analyst, a detection engineer, a threat hunter and a vulnerability-management agent are asking different questions about the same event. Feed them all the same generic answer and at least one of them is getting fluff instead of the specific technical detail they actually need.
Is this real, and how bad is it?
Malware behaviour, a scored verdict with its reasoning, a phishing page’s screenshot, whether a certificate is self-signed — the Enrichment API answers all of it as callable tools, not a summary to double-check.
What do I actually search for?
Not a paragraph restating the report. Sigma rules, YARA signatures, extracted command lines and mapped ATT&CK techniques — technical primitives ready to become a query, not prose to re-read.
What’s worth checking, in our environment?
Leads scoped to what you actually run — which actors target your sector and region, cross-referenced against your software and geography, not a global top-ten list everyone else already has.
Which CVEs actually matter to us, right now?
Whether a CVE is tied to an actor or campaign, and whether that actor targets your sector — so patching gets prioritised by who is exploiting it, not by CVSS alone.
What else does this touch?
One indicator resolves to the campaign, the actor and the malware family behind it — so triage starts with the blast radius, not an isolated IOC.
Can I act on this without a human checking first?
A published known-good verdict and an auditable score, not a badness number to interpret — the difference between an indicator you can act on and one you have to escalate.
Give your agents something they can check.
Our scoring is published and every answer carries its source. The trial below covers Threat Feed — for CTI Assistant, API or MCP access, email trial@rstcloud.com.