IOC enrichment & SIEM push
Indicators from leak sites, abuse feeds, and exploit sources — enriched with GreyNoise, Shodan, VirusTotal, passive DNS, and Pulsedive — pushed to Splunk HEC, Elastic or Microsoft Sentinel.
Solutions · SOC & threat-intel teams
Enriched, deduplicated intel straight into Splunk, Elastic or Sentinel.
IOCs mapped to MITRE ATT&CK techniques, pushed to your SIEM. Hunting tools, relationship graphs and gang activity analysis built in.
Use cases
Three ways SOC teams use Offsys Intel.
Threat hunting & graph analysis
Relationship graph linking gangs to victims, actors, and techniques. Search across the full dataset, filter by sector, country, gang, MITRE technique or time range.
Detection content
IOC Bulletin briefings with matching Sigma and YARA rules, ready to deploy. Each indicator comes with source, confidence level and TLP marking.
Features you'll use
Built for analysts and detection engineers.
- SIEM push — Splunk HEC, Elastic, Microsoft Sentinel
- STIX 2.1 exports and TAXII 2.1 server
- MISP integration
- IOC enrichment — GreyNoise, Shodan, VirusTotal, passive DNS, Pulsedive, DGA detection
- MITRE ATT&CK technique mapping
- Relationship graph — gangs, victims, actors, techniques
- Gang activity heatmaps and risk scores
- Activity-spike detection and victim risk clustering
- CVE tracking with EPSS scores and ransomware links
- IOC Bulletin — weekly, with Sigma & YARA rules
- REST API with API-key authentication
Example workflow
A day in the life.
01
New IOCs land in your SIEM
Offsys Intel pushes enriched indicators to your Splunk instance via HEC. Each IOC carries its MITRE ATT&CK mapping, source and TLP.
02
Weekly IOC Bulletin arrives
Your detection engineers get a curated bulletin with the week's IOCs, matching Sigma rules and YARA signatures, prioritised by relevance to your sector.
03
Hunt across the graph
An analyst investigates a gang's targeting pattern using the relationship graph. They trace connections between victims, techniques and actors across months of data.
Fictional workflow.
See the intel in your SIEM.
Book a 20-minute walkthrough. We'll show you the IOC feed, graph tools and SIEM integration live.
Book a walkthrough