Version changelog.

Threat Coverage

Threat Coverage is a navigator-style matrix of techniques, not a static list of tactics.

• MITRE ATT&CK Enterprise, ICS, and Mobile, plus additional frameworks in the same catalog.
• Overlays for the detections you have written, the security tools you have deployed (AWS, Azure, GCP, NIST 800-53, Microsoft 365), and known-exploited vulnerabilities.
• Coverage gaps are visible on the matrix, and the view exports.

A technique in the news or in a report opens here, so coverage is tied to what you are actually watching.

Report builder and templates

Reports are composed in a builder, block by block, with a live preview. You are not filling in a single text box.

• Starter templates: Monthly Threat Landscape, Weekly Threat Report, Monthly Metrics, Industry Threat Landscape and Incident Report.

Save any finished report as your own template. Schedule a report to go out by email.

Industry intelligence

Industries are a library of their own. Open a sector and see the threat activity that applies to it: actors, incidents, reporting, and news. A managed provider can look across the industries in the customer portfolio. The Industry Threat Landscape template turns that view into a report.

Program Management metrics

Program Management includes a Metrics view. Pre-built activity views cover alerts, requests for information, threat hunts, and investigations, plus exposure management and digital risk protection when those modules are on. Pivot by status, severity, and analyst instead of exporting a spreadsheet to answer “what did we do.”

Analytics Engine

Analytics Engine is a query language over your intelligence and the global catalog.

• Filter indicators, threat groups, news, marketplace listings, and physical-security events.
• Aggregate with stats, join relationships, and sort.
• Open any result, drop rows into an investigation, or show rows that have coordinates on a map.

The same query style is what scheduled alert rules evaluate.

Threat hunt integrations

A hunt can be launched into the security tools you have connected, from the hunt itself. You do not copy indicators into each console.

• Hunt sources include Microsoft Sentinel, Microsoft Defender, CrowdStrike, Palo Alto Cortex XSOAR, SentinelOne, Google Security Operations, IBM QRadar, Abnormal, Akamai DNS, Proofpoint, Mimecast, Carbon Black, and AWS GuardDuty.

Which ones appear depends on the connections enabled for the organization.

Investigations

Investigations are a canvas for one case. Pin evidence, link the indicators, actors, and reports that belong to it, and add rows straight from an Analytics Engine query. Active and closed investigations are listed together, and investigation activity is included in Program Management metrics.

New suspicious-domain sources

Lookalike domains now come from three collectors, and each finding is marked with its source.

• Pathfinder generates domain permutations of the brands you monitor (typos, extra words, other endings) and keeps the ones that are registered. Registered domains are scanned and scored.
• Jaywalking reads registry zone files and finds domains that contain a brand name as a whole word. Those matches go through the same enrichment as Pathfinder.
• Snakeoil checks sponsored search results for ads pointing at domains that resemble yours.

Third Party Intelligence

Third parties are a catalog you can watch, not a spreadsheet of vendor names. Each vendor has a profile and a risk level. The ones you watchlist show up on the Digital Risk Protection overview, highest risk first.

Exposed cloud files

Exposed cloud files are their own list: public files and buckets found for the keywords and brands you monitor, with the provider and bucket on the record. New files can raise an alert.

Marketplace listings and relevancy scoring

Dark-web marketplace listings for stealer logs are collected and shown in Digital Risk Protection. Each listing is scored against your monitored assets.

• A relevance level and score, so the listings that touch you sort first.
• Counts of matched hosts, including hosts you have marked high value.
• The stealer family on the listing, so you can see which families show up most often.

When a listing is for sale, a purchase request can be submitted from that listing.

Exposure management (CTEM)

Continuous threat exposure management is a module of its own.

• Assets, probes, and results. What was scanned, from where, and what came back.
• Scanners. Findings from Qualys, Tenable, Rapid7, and Morado CTEM in one list, with detail on each finding.
• Reports. A narrative exposure report, with optional Morado AI sections, or a raw export of the matching findings as CSV or PDF.
• Alerts. New results land in the same alert inbox as the rest of the platform.

Physical Security

Physical security is its own module.

• An operations map of areas of interest, nearby events, and news tied to those areas.
• Site risk and travel safety as separate views.
• Open transportation cameras and shipping traffic in the current map view.
• A request for satellite imagery on an area of interest, a place, or a rectangle drawn on the map.
• War rooms reuse the same map and areas on their operations view.
• Events can be queried in the Analytics Engine, including events inside an area of interest.

IOC feeds

Indicator feeds are turned on per organization under Settings. Open and licensed feeds land as indicators you can hunt, alert on, and push to controls.

• The catalog includes ThreatFox, URLhaus, MalwareBazaar, Feodo Tracker, AlienVault OTX, PhishTank, OpenPhish, Spamhaus DROP, AbuseIPDB, GreyNoise, VirusTotal, Recorded Future, Mandiant Advantage, and CrowdStrike Intelligence, among others.

Licensed feeds use the credentials you enter. They are not the same screen as the security-tool integrations.

ISAC integrations

You can take intelligence from an ISAC or another partner without pasting it in.

• Poll a partner or ISAC TAXII 2.1 collection into the organization.
• Publish your own TAXII collection for partners you choose.
• Sharing circles, so an accepted invitation is what allows intelligence to move between organizations.
• MISP feeds, for communities that already exchange indicators that way.

Integrations

The connector catalog is much wider than the previous platform. Connections are configured under Settings → Integrations, tested from that screen, and then used in two places: Launch on a hunt, and Push to controls on an indicator.

• Newly available connections include Palo Alto NGFW, Abnormal, Akamai WAF and DNS, EfficientIP, Nozomi, SentinelOne, IBM QRadar, Google Security Operations, Cisco Umbrella, Fortinet, Proofpoint, Carbon Black, Mimecast, Check Point, Cloudflare Gateway, and AWS GuardDuty. Microsoft Sentinel, Microsoft Defender, CrowdStrike, and Palo Alto Cortex XSOAR are still there.

The platform does not replace your SIEM. A connector is a hunt, a control push, or both.

Workflows and automations

Automations are built on a canvas instead of a fixed rule list.

• One trigger: a platform event, a schedule, or a manual run.
• Conditions to keep the noisy cases out.
• An approval step that waits for a person before the rest of the playbook runs.
• Actions for email, Slack, webhooks, tickets (including Jira and ServiceNow), hunts, investigations, tags, and export.
• A run history with status, timing, and the step log. Runs waiting for approval show on the workflow dashboard.

Morado AI

Morado AI is a chat assistant over the intelligence your organization is allowed to see. Ask it about an actor, a report, an alert, or a set of findings, and it answers from those records. It also shows up in three other places:

• A workflow step that summarizes or extracts, inside a playbook.
• Optional sections when you generate an exposure report.
• A short note on the morning email explaining why that day's items matter to the organization.

AI that would change data waits for a person to confirm it.