Threat Profiles

Validin aggregates threat indicators from the Maltrail project, which is frequently updated with indicators and links to open-source threat intelligence on thousands of named threats. You can search for named threats (and, frequently, their aliases), explore publiclyreported indicators, and find direct links to blogs, tweets, Validin searches, and other sources that have been used to create attribution to specific threats.

The main Threat Profiles page within Validin provides a searchable interface for threat names, recently added indicators, and recent public threat reports.

Threat Profiles for thousands of threats from public reporting

Recently Added Indicators show indicators that were recently added from open-source threat intelligence sources.

The "Recent Open Source Reports" provide direct links to published sources of threat intelligence, the date the reports were added, and the threat actor identified in the report.

Find recent public threat reports

Threat Profile Details

Clicking on a named threat in the overview brings you to a detailed view of that threat. The detailed view shows a summary, a table of indicators, and a means to view the public reporting associated with the threat.

Threat details with indicator summary, table of indicators, and resources

Clicking on an individual indicator will initiate a search within Validin for that indicator.

Clicking on the table cell around the indicator will open a contextual slideout with information about it. This information includes a direct link to the context for the named threats that an indicator is associated with and direct links to the reports and public references to that indicator.

The indicator slideout provides context for specific indicators, including the public reports associated with that indicator.

The "Resources" tab enumerates references to public threat reports, including blogs, tweets, Validin searches, and other sources that have been used to identify or expand known indicators for named threats. These direct links will open in a new tab to enable you to understand the context around indicator reporting associated with this named threat.