Overview
Threat Intel is the external-threat surface platform for MSPs. It watches what happens outside your clients' organizational perimeters — dark web credential dumps, lookalike domain registrations, and vendor breaches — and surfaces the information before attackers can act on it. It is built for MSP security analysts and administrators managing threat visibility across multiple client tenants.
Threat Intel feeds breach findings and threat events into other platform products. Other services query it for threat posture data, and its breach-response automation pushes directly into your PSA and onto the platform event bus.
What Threat Intel Monitors
Threat Intel watches external exposure surfaces:
- Dark web / credential exposure — the email addresses of the users you manage are checked against Enzoic's breach-exposure data, surfacing every known breach a managed address has appeared in and what data was exposed. This is per-account by email — see Dark Web Monitoring.
- Lookalike domains (Complete tier) — newly registered domains that impersonate a client's brand, detected via WhoisXML and DNS resolution.
- Supply-chain vendors (Complete tier) — registered vendors whose domains are cross-checked against breach data.
Data-source note: dark-web / credential-exposure monitoring is powered by Enzoic (per-account email only — no domain, keyword, or paste-site scanning). The lookalike-domain and supply-chain-vendor surfaces described here reflect the retired standalone Threat Intel product and are not backed by the current live dark-web integration; treat them as legacy/aspirational until re-verified against a live implementation.
Tier Summary
| Feature | Essentials | Complete |
|---|---|---|
| Dark web monitoring | Yes | Yes |
| Credential exposure | Yes | Yes |
| Basic breach response automation | Yes | Yes |
| Threat narrative (AI QBR reports) | No | Yes |
| Lookalike domain monitoring | No | Yes |
| Supply-chain risk | No | Yes |
| Priority alerting | No | Yes |
Threat Intel is part of the all-inclusive platform plan — there is no separate per-user price for it, so the Essentials and Complete columns above show which capabilities each level has, not what each level costs. (The figures that used to head those columns were removed 2026-09-23: no source for them exists in the platform's product catalogue, rate card or billing configuration.)
How Threat Intel Feeds Other Products
Other platform products pull a 30-day threat posture rollup from Threat Intel using a service-to-service endpoint. Defend can query per-email credential exposure directly. When breach-response automation fires, Threat Intel emits events to the platform Bus — threatintel.breach_detected, threatintel.lookalike_registered, and threatintel.supply_chain_alert — which flow to any subscribing product or workflow. PSA tickets are opened automatically when breach-response rules are configured.
The Dashboard
The MSP-wide dashboard shows aggregate findings across every client tenant: new findings this week, unresolved breaches, open vendor alerts, and lookalike registrations. The Intel Briefing view provides a tenant-scoped summary you can use in your weekly review.
FAQ
Does Threat Intel access the live dark web (Tor)? No. It uses curated breach-exposure data from Enzoic, which performs the dark-web collection. Threat Intel queries that curated data for the email addresses of the users you manage.
Who should use Threat Intel? MSP security analysts monitoring client exposure and MSP administrators who configure automation rules, set up client monitors, and review breach findings. It is not a developer tool.
Where does Threat Intel sit in the product lineup?
It is a standalone product under app.theonestack.com/threat-intel. It integrates with Defend, the PSA, and the platform Bus, but runs as its own service.