Part of Defend, in progress — Threat Intel and Security are now part of Defend, not separate products. This area is still being built: some screens, menu names and actions described here may not be available yet, or may still show the older Threat Intel or Security names.
Overview
Defend threat intelligence surfaces indicators of compromise (IOCs) through its dark web findings, credential exposure reports, and breach event data. This information is made available to other platform products — including the rest of Defend — via the platform Bus and the integration threat-summary endpoint. MSP security analysts use IOC data to understand which credentials, domains, and vendor relationships pose active risk to their clients.
What Are IOCs in Defend threat intelligence
In the context of Defend threat intelligence, IOCs are data points that indicate a known or likely compromise. The product works with the following types:
- Compromised credentials — managed-user email addresses found in breach data, including the exposed data classes (passwords, hashes, phone numbers, etc.)
- Lookalike domains (Complete tier) — newly registered domains with similarity to a protected brand domain, which may indicate phishing infrastructure being set up
- Vendor breach indicators (Complete tier) — vendor domains that have appeared in breach data
Compromised-credential IOCs are sourced from Enzoic (per managed-user email address). Lookalike detection uses WhoisXML's newly registered domains feed.
Note: the credential/breach IOCs are per-account by email (Enzoic). The lookalike-domain and vendor-domain breach surfaces reflect the retired standalone Threat Intel product and are not backed by the current live dark-web integration.
How IOCs Flow to Other Products
Defend threat intelligence emits three types of events on the platform Bus:
| Event | Trigger |
|---|---|
threatintel.breach_detected |
A dark web scan finds a new breach for a monitored email or domain |
threatintel.lookalike_registered |
The lookalike scanner detects a new candidate domain (Complete tier) |
threatintel.supply_chain_alert |
A vendor's domain appears in a breach (Complete tier) |
All three events are emitted on the Bus security channel. Defend, RMM, and PSA can subscribe to these events to trigger their own workflows.
Other products can also pull a 30-day threat posture rollup directly from Defend threat intelligence using the integration endpoint — this returns aggregate counts of findings, open vendor alerts, and lookalike registrations for a tenant.
Viewing IOC Data in Defend threat intelligence
Breach and credential IOCs are accessible in two places:
- Dark Web findings list — all matches from active monitors, with breach name, date, and data classes exposed.
- Credential Exposure — per-email view showing every breach a managed address has appeared in across Enzoic's exposure history.
For each finding you can generate a remediation plan that translates the IOC into actionable steps: which passwords to rotate, where to enable MFA, what account settings to audit.
FAQ
Does Defend threat intelligence provide a downloadable IOC file (STIX, CSV)? The product surfaces IOC data through its dashboard, findings list, and integration endpoints. The source documentation does not describe a downloadable STIX or IOC feed file export.
How quickly does a new breach appear as an IOC in Defend threat intelligence? The dark web scanner runs once a day. A new breach exposure added to Enzoic's data for a managed address will appear in findings within the next scheduled scan after it is available upstream.
Which products receive Defend threat intelligence IOC events automatically?
Any product subscribed to the alert.critical channel on the platform Bus receives the events. Whether a specific product acts on them depends on that product's configuration. See Integrations for per-product detail.