Threat Intelligence & IOC Matching

Correlate attacks against threat feeds and custom indicators of compromise

Threat Feeds

Flowtriq ingests and correlates against five threat intelligence feeds, updated automatically:

Feed	Source	Update Frequency	Content
CISA KEV	US Cybersecurity & Infrastructure Security Agency	Daily	Known exploited vulnerabilities filtered to network-facing products (Fortinet, Cisco, Palo Alto, Juniper, Citrix)
Emerging Threats	Proofpoint ET	Daily	Compromised IP addresses actively participating in attacks
URLhaus	abuse.ch	Every 15 min	Active malware command-and-control infrastructure
CERT.PL	Polish CERT	Daily	Network-level threat indicators
Trickest CVE PoC	Trickest	Daily	CVE proof-of-concept exploit database

IOC Patterns

In addition to the feeds, Flowtriq matches traffic against 38 built-in IOC patterns:

28 CVE exploit signatures: FortiOS, PAN-OS, Cisco IOS XE, Citrix Bleed, Log4Shell, OpenSSH regreSSHion, HTTP/2 Rapid Reset, and more
10 network protocol exploits: SIP, MGCP, SSLv3 POODLE, Shellshock, JNDI injection, path traversal probes

Custom IOC Patterns

Create custom patterns from Dashboard → Threat Intel → IOC Patterns. Each pattern supports:

Field	Description
Pattern type	IP address, ASN, domain, regex signature, campaign tag
Confidence	0-100 score indicating reliability of the indicator
Attack family	Which attack type this IOC correlates with

Enrichment

When an incident is detected, Flowtriq automatically correlates source IPs against all active feeds and IOC patterns. Matches appear in the incident detail with the feed source, confidence score, and IOC metadata. This gives you immediate context about whether the attack comes from known bad infrastructure.

IP Reputation

The IP reputation system aggregates data across feeds to produce a composite risk score for any IP address. Query reputation from Dashboard → Threat Intel or via the API at GET /api/dash/reputation.php?ip=1.2.3.4.