Productthreat-intel.uz
See the attack before the attacker moves.
Threat intelligence focused on your sector and region: active campaigns, attacker infrastructure, leaked credentials. What we find becomes an action, not an alert.
- APT profiles
- IOC feed
- MITRE ATT&CK
- Dark web
Why it matters
The problem
Global threat databases are large, but they do not show the specific campaign aimed at your bank: their sensors sit elsewhere, and the local language and fraud schemes fall outside their coverage. So the first signal becomes the incident itself.
Our answer
Threat Intelligence closes that gap: regional sources, APT profiles for your sector and indicators delivered straight into your security tools.
What is included
06 modulesThreat Intelligence
- APT profiles
- IOC feed
- MITRE ATT&CK
- Dark web
- 01
APT profiles
Groups targeting your sector, their techniques and tools, mapped to MITRE ATT&CK.
- 02
IOC feed
IP, domain, hash and URL indicators delivered over an API to SIEM, firewall and EDR; stale indicators are retired automatically.
- 03
Breach monitoring
Closed forums, paste sites and infostealer logs: an immediate alert when credentials for your domain appear.
- 04
Brand and executives
Dark web and Telegram monitoring for the company name, domains and executives’ names.
- 05
Analytical reports
Weekly and urgent reports: what is happening, how it concerns you and what to do.
- 06
An analyst on the line
There is a person behind every indicator: questions are answered by an analyst, not a feed.
How it goes
04 steps
- 01
Profile
Your sector, assets and current security tools are established.
- 02
Connect
The IOC feed is connected to SIEM, firewall or EDR and verified in test mode.
- 03
Monitor
Sources are watched continuously; findings that concern you arrive with context.
- 04
Act
A concrete recommendation for every finding: block, reset passwords, warn staff.
What you get
- 01
IOC feed
Continuously updated indicators connected to your security tools.
- 02
Threat profiles
A report on the groups and techniques relevant to your sector.
- 03
Urgent alerts
Immediate notice and advice when a leak or campaign concerning you is found.
Questions
All productsWe already have a global feed. Is this redundant?
A global feed gives breadth, we give regional depth. They work together: we see the local campaign global sources miss.
Can we connect without a SIEM?
Yes. Indicators go straight to a firewall or EDR, or arrive as a report.
Where do the leaks come from?
Closed forums, paste sites, dark web markets and infostealer logs. Only the part concerning your organisation is shown.
Where is the data stored?
In Uzbekistan. Reports and indicators never leave for an external cloud.
Let’s start
Start with a free external check
Give us your domain and we return a first report on your external attack surface and leaked accounts. Nothing is installed, nothing is blocked; the scope is agreed based on the result.
- Subdomains, open ports and expired certificates
- Corporate accounts found in breaches
- The three most important issues and where to start