Threat intelligence analysts and builders. Talk to someone who does this work, and get a straight answer.
Contact usGet a DemoStart a free trialConnected to the tools and intelligence you already use.
Enrich indicators, hunt in your SIEM and EDR, push approved indicators to the controls that act on them, bring in vulnerability data, and send findings to the teams who fix them.
Threat intel enrichment
Add context to every indicator during IOC enrichment.
AlphaMountain
Risk, categorization, WHOIS and passive DNS context for domains, IPs and URLs.
Custom HTTP enrichment
Send IOCs to your own webhooks and map the response into each enrichment summary.
DomainTools
Iris Investigate lookups and risk scores for domains, URLs and IPs.
EmailRep
Reputation, suspicious flags and risk signals for email indicators.
GreyNoise
Separate internet scanners from targeted activity for IPv4 indicators.
Hunt.io
Internet-wide threat intelligence for enrichment and retroactive hunts.
Mozilla ODIN
Public GenAI vulnerability disclosures in the report library, and the ODIN threat feed with a subscription.
AlienVault OTX
Pulses plus related malware, geolocation and URL context.
Silent Push
Domain and IP enrichment, IOFA threat feeds and proactive threat hunting.
ThreatFox
Look up domains, IPs, URLs and file hashes in abuse.ch ThreatFox.
URLScan
Historical scans with verdicts and screenshots for domains, URLs and IPs.
Validin
Historical DNS, reputation and infrastructure context for domains and IPs.
VirusTotal
Multi-engine reputation and detections for hashes, URLs, domains and IPs.
VirusTotal Sandbox
Behavioral analysis of files and URLs, shown alongside each indicator.
Vulnerability & attack surface
Bring scanner findings and exposure data into Exposure Management.
Censys
Host and service exposure data for domains and IPs.
Qualys TruRisk
Qualys VM hosts and vulnerability detections in Exposure Management.
Rapid7 InsightVM
InsightVM assets and vulnerabilities in Exposure Management.
Shodan
Host, port and subdomain intelligence for domains and IPs.
Tenable
Tenable assets and vulnerability detections in Exposure Management.
SIEM & log analytics
Run retrospective hunts where your logs live, and send indicators to your detections.
AWS S3
Scan log and text objects in S3 buckets for IOC matches.
Elastic Security
Retrospective hunts across Elasticsearch log indices.
Google Security Operations
UDM hunts, and indicators sent to reference lists your detection rules use.
IBM QRadar
AQL retrospective hunts across QRadar events.
Microsoft Sentinel
Hunt queries and incident forwarding.
Palo Alto Cortex XSOAR
Hunt indicators and incidents, and create XSOAR incidents from alerts and workflows.
Snowflake
SQL hunts against your Snowflake warehouse.
Splunk
SPL hunts across Splunk indexes, and detection signatures deployed as saved searches.
EDR / XDR
Hunt on endpoints and push indicators to the agents that act on them.
Carbon Black Cloud
Alert hunts and custom IOC feeds.
CrowdStrike Falcon
Threat hunts, Falcon Intelligence lookups, custom IOCs and alert ingest.
Microsoft Defender
Advanced Hunting KQL hunts and custom threat indicators.
SentinelOne
Singularity threat hunts and custom IOC and restriction push.
Email security
Find out whether a new indicator has already reached inboxes.
Abnormal Security
Hunt Abnormal threats and search messages by IOC.
Mimecast
Hunt Mimecast URL click logs.
Proofpoint TAP
Hunt Targeted Attack Protection events.
Network, DNS & firewall
Turn approved indicators into blocks and monitoring at the edge.
Akamai DNS
Check domains and IPs against Secure Internet Access intelligence.
Akamai WAF
Add IP indicators to Akamai Network Lists.
Check Point
IP, domain, URL and hash indicators in threat-indicator lists.
Cisco Umbrella
Domains and IPs in destination lists for DNS enforcement.
Cloudflare Gateway
Domains and IPs in Zero Trust Gateway block lists.
EfficientIP
Domain indicators in SOLIDserver DNS RPZ and threat lists.
Fortinet FortiGate
IP and FQDN indicators in firewall address groups.
Nozomi Networks
STIX indicators in Guardian and CMC for OT/ICS visibility.
Palo Alto NGFW
IP indicators in Dynamic Address Groups.
Cloud & identity
Hunt cloud findings and protect accounts.
AWS GuardDuty
Hunt GuardDuty findings for selected indicators.
Microsoft Entra ID
Validate compromised credentials and protect accounts: password reset, session revocation and user notification.
ITSM & collaboration
Get findings to the people and queues that act on them.
Jira
Tickets from hunts, follow-up actions and Exposure Management findings.
Microsoft Teams
Channel notifications for Morado events.
PagerDuty
Escalate high-severity alerts.
RSA Archer
Threat intelligence records in Archer GRC.
ServiceNow
ITSM and Security Incident Response records, with status sync.
Slack
Channel notifications for Morado events.
Threat intelligence feeds
Open-source, community and commercial feeds, ingested, deduplicated and scored alongside your own intelligence.
AbuseIPDB
AI Honeypot Observatory
AlienVault OTX
AlphaMountain Community Threat 1000
Anomali ThreatStream
Binary Defense Banlist
Blocklist.de
Blocklist.de Brute Force
botvrij.eu OSINT
C2IntelFeeds
CERT Polska Warning List
CINS Army
CrowdSec CTI
CrowdStrike Falcon Intelligence
CyberCrime Tracker
Dataplane SSH Brute Force
Dataplane Telnet Brute Force
DIGITALSIDE Threat-Intel
DShield Top IPs
Emerging Threats Compromised IPs
Feedly
Feodo Tracker
GreenSnow
GreyNoise Malicious
Hunt.io IOC Hunter
IBM X-Force Exchange
IPinfo
IPsum
Maltrail
MalwareBazaar
Mandiant Advantage
OpenPhish
Palo Alto AutoFocus
PhishTank
Polarity
PromptIntel
Recorded Future
Spamhaus DBL
Spamhaus DROP
SSLBL
StopForumSpam
ThreatFox
Tor Exit Nodes
URLhaus
VirusTotal Intelligence
VXVault
ISACs & MISP communities
Connect to the MISP servers of your ISAC or ISAO, or add your own private MISP instances, and sync the events that match your filters.
Ransom-ISAC
FS-ISAC
Health-ISAC
MS-ISAC
RH-ISAC
Custom MISP servers
Add private or internal MISP instances as IOC feeds for your organization.
No integrations match your search. Ask us about it.
Don't see your tool?
Custom HTTP enrichment and the Morado API connect almost anything. Tell us what you run.
See Morado in action.
Book a demo and see Morado built around your organization: your exposure, your threats and the workflows to act on them.
Questions first? Contact us.