Alternatives to ELLIO
Compare ELLIO alternatives for your business or organization using the curated list below. SourceForge ranks the best alternatives to ELLIO in 2026. Compare features, ratings, user reviews, pricing, and more from ELLIO competitors and alternatives in order to make an informed decision for your business.
-
1
ManageEngine Log360
Zoho
Detect, investigate, and resolve security incidents and threats using a single, scalable SIEM solution. Log360 provides you with actionable insights and analytics-driven intelligence for real-time security monitoring, advanced threat detection, incident management, and behavioral analytics-based anomaly detection. Built as the bedrock for your SOC, ManageEngine Log360 comes with out-of-the-box correlation and workflow rules, dashboards, reports, and alert profiles to help you address vital security issues with little manual intervention. -
2
ConnectWise SIEM
ConnectWise
ConnectWise SIEM (formerly Perch) offers threat detection and response backed by an in-house Security Operations Center (SOC). Defend against business email compromise, account takeovers, and see beyond your network traffic. Our team of threat analysts does all the tedium for you, eliminating the noise and sending only identified and verified treats to action on. Built with multi-tenancy, ConnectWise SIEM helps you keep clients safe with the best threat intel on the market.Starting Price: $10 per month -
3
SOC Prime Platform
SOC Prime
SOC Prime operates the world’s largest and most advanced platform for collective cyber defense that cultivates collaboration from a global cybersecurity community and curates the most up-to-date Sigma rules compatible with over 28 SIEM, EDR, and XDR platforms. SOC Prime’s innovation, backed by the vendor-agnostic and zero-trust cybersecurity approach, and cutting-edge technology leveraging Sigma language and MITRE ATT&CK® as core pillars are recognized by the independent research companies, credited by the leading SIEM, XDR & MDR vendors, and trusted by 8,000+ organizations from 155 countries, including 42% of Fortune 100, 21% of Forbes Global 2000, 90+ public sector institutions, and 300+ MSSP and MDR providers. Driven by its advanced cybersecurity solutions, Threat Detection Marketplace, Uncoder AI, and Attack Detective, SOC Prime enables organizations to risk-optimize their cybersecurity posture while improving the ROI of their SOC investments. -
4
SIRP
SIRP
SIRP is an AI-native Autonomous SOC platform. Not a SOAR upgrade. A replacement for the architecture that made SOAR necessary in the first place. Where legacy SOAR executes static playbooks, SIRP deploys AI agents that analyze alerts, compute risk, and execute response decisions autonomously, within defined policy boundaries, with full audit coverage. No manual triage. No static playbook logic. No human in the loop for routine Tier-1 cases. The platform learns from every outcome. Detection gets sharper. Response gets faster. The SOC operates at machine speed without surrendering governance or control on decisions that warrant human judgment. Built for enterprise SOC teams and MSSPs that are done waiting for a copilot to tell them what to do. -
5
Smokescreen
Smokescreen
Smokescreen is a deception technology & active defense company that provides a solution that blankets your network with decoys to trap hackers. With a demo of our product, IllusionBLACK, you'll understand how adversaries operate and see how decoys planted all over your network provide high-fidelity detections every step of the way. It's easy to understand, easy to use, and we've got you covered on the Perimeter, Cloud, internal network, endpoints, and Active Directory. Launch your first deception campaign using ready-made decoys. Focus on detecting threats instead of wasting countless man-days configuring a new solution. Any interaction with an IllusionBLACK decoy is a high-confidence indicator of a breach. When you get an alert, you know it’s the real deal. Automated forensics and root-cause analysis in two clicks. Accomplish more in a fraction of the time with half the team. Out-of-the-box integrations with SIEMs, Firewalls, EDRs, Proxy, threat intel feeds, SOAR, and more.Starting Price: $7,750 per year -
6
Darkfeed
Cybersixgill
Unleash cyber security performance, supercharge your security stack and maximize analysts’ performance with the ultimate underground threat intelligence collection available. Darkfeed is a feed of malicious indicators of compromise, including domains, URLs, hashes, and IP addresses. It relies on Cybersixgill’s vast collection of deep and dark web sources and provides unique and advanced warnings about new cyberthreats. It is automated, meaning that IOCs are extracted and delivered in real-time, and it is actionable, meaning that its consumers will be able to receive and block items that threaten their organizations. Darkfeed also offers the most comprehensive IOC enrichment solution on the market. By enriching IOCs from SIEM, SOAR, TIP or VM platforms, users gain unparalleled context and essential explanations in order to accelerate their incident prevention and response and stay ahead of the threat curve. -
7
alphaMountain Threat Intelligence APIs and Feeds
alphaMountain AI
alphaMountain’s domain and IP threat intelligence powers many of the world’s leading cybersecurity solutions. High-fidelity threat feeds are updated hourly with fresh URL classification, threat ratings and actionable intelligence on over 2 billion hosts including domains and IP addresses. KEY BENEFITS: Get high-fidelity URL classification and threat ratings for any URL from 1.00 to 10.0. Receive fresh categorization and threat ratings updated every hour, syndicated via API or threat feed. See threat factors and other intelligence contributing to threat verdicts. USE CASES: Use threat feeds in your network security products such as secure web gateway, secure email gateway or next-generation firewall. Call the alphaMountain API from your SIEM to investigate threats or from your SOAR to automate responses such as blocking and policy updates. Detect if a URL is suspicious, contains malware, is a phishing site and which of 89 content categories the site belongs to.Starting Price: $300/month -
8
WhoisXML API
WhoisXML API
For over a decade, we have collected, aggregated, and delivered domain, IP, and DNS intelligence to make the Internet more transparent and secure. Our data feeds and APIs have proven invaluable in augmenting the capabilities of commercial security platforms (SIEM, SOAR, TIP, ASM) and supporting threat detection and response (TDR), third-party risk management (TPRM), identity access management (IAM), and other cybersecurity processes. Law enforcement agencies, managed security service providers (MSSPs), and security operations centers (SOCs) benefit from our intelligence to defend against advanced persistent threats (APT), fight cybercrime, and achieve superior network visibility. Fortune 1000 companies and SMBs rely on our data to protect their digital assets, extend their brand protection efforts, detect phishing and fraud, and monitor the global domain activity landscape. -
9
Maltiverse
Maltiverse
Cyber Threat Intelligence made simple for all types of businesses and independent analysts of cybersecurity. Maltiverse Freemium online resource to access aggregated sets of indicators of compromise with full context and history. When you have a cyber security incident and you need context to respond - you can access the database and search for the content manually. You can also connect the customized set of new threats to your Security Systems like SIEM, SOAR, PROXY or Firewall: Ransomware, C&C centers, malicious IP and URLs, Phishing Attacks, Other feeds.Starting Price: $100 per month -
10
Rapid7 Threat Command
Rapid7
Rapid7 Threat Command is an advanced external threat intelligence tool that finds and mitigates threats directly targeting your organization, employees, and customers. By proactively monitoring thousands of sources across the clear, deep, and dark web, Threat Command enables you to make informed decisions and rapidly respond to protect your business. Quickly turn intelligence into action with faster detection and automated alert responses across your environment. This is made possible through plug-and-play integrations with your existing technologies for SIEM, SOAR, EDR, firewall, and more. Simplify your SecOps workflows through advanced investigation and mapping capabilities that provide highly contextualized alerts with low signal-to-noise ratio. Unlimited 24/7/365 access to our expert analysts shortens investigation times as well as accelerates alert triage and response. -
11
Threat Landscape
Ecliptica Labs AB
Threat Landscape is an automated threat intelligence platform built for security analysts and SOC teams who need high-confidence, actionable intelligence — without the manual triage. The platform continuously ingests and processes global OSINT and darknet sources, automatically extracting structured facts and filtering out noise before it reaches analysts. All intelligence is normalized into STIX 2.1 format, MITRE ATT&CK mapped, and correlated across threat actors, malware families, CVEs, TTPs, and IOCs — so teams spend time acting on intelligence, not building it. Key capabilities include interactive dashboards, visualized STIX threat graphs, advanced search and filtering, darknet monitoring for leak-site claims and criminal chatter, automated daily and weekly digests, and a RESTful API for integration with SIEM, SOAR, and TIP platforms.Starting Price: $499/month -
12
Digital Element
Digital Element
Leverage context-rich IP intelligence data, including geolocation, proxy, and vpn insights to improve decision-making. Accurately geolocate an IP address down to the postal code/ZIP level. Accuracy is more than 97% at the city level and 99.99% at the country level, worldwide. Our data covers 99.9999% of all seen IP addresses, with support for both IPv4 and IPv6 addresses. As the pioneer and global leader of IP geolocation technology, we are the expert at harnessing IP intelligence data for diverse applications. Digital Element offers the most comprehensive IP intelligence data sets. Our NetAcuity and Nodify solutions deliver a wealth of insights and information beyond geolocation to support advanced applications in geo-targeted advertising, content localization, compliance, fraud detection & prevention, cybersecurity, digital rights management, and more. Detect proxy & VPN connections, including those from residential proxies. -
13
CounterCraft
CounterCraft
Unlike other security companies, we offer real-time intel that organizations can use to manipulate adversarial behavior even before being attacked. We built a distributed threat deception platform that allows you to take a step forward in defense. Take back control. We have built the highest-quality deception platform for active defense. Our proprietary ActiveLures™ populate ActiveSense™ environments and communicate using our ActiveLink™ technology. -
14
Cyren
Cyren
Cyren Inbox Security is an innovative solution that turns the tables on the phishers and safeguards each and every Office 365 mailbox in your organization against evasive phishing, business email compromise (BEC) and fraud. Continuous monitoring and detection provide early exposure of evasive attack indicators and anomalies. Automated response and remediation for individual mailboxes and across all mailboxes in the organization will take care of the heavy lifting. Our unique crowd-sourced user detection closes the feedback loop on alerts, reinforcing your security training and providing valuable threat intelligence. Comprehensive, multi-dimensional presentation of critical threat characteristics to help analysts understand the evolving threat landscape. Improved threat detection for existing security products such as SIEM and SOAR solutions. -
15
Bitdefender Advanced Threat Intelligence
Bitdefender
Fueled by the Bitdefender Global Protective Network (GPN), Bitdefender Advanced Threat Intelligence collects data from sensors across the globe. Our Cyber-Threat Intelligence Labs correlate hundreds of thousands of Indicators of Compromise and turn data into actionable, real-time insights. By delivering our top-rated security data and expertise directly to businesses and Security Operations Centers, Advanced Threat Intelligence bolsters security operations success with one of the industry’s broadest and deepest bases of real-time knowledge. Improve threat-hunting and forensic capabilities with contextual, actionable threat indicators on IPs, URLs, domains and files known to harbor malware, phishing, spam, fraud and other threats. Decrease time to value by seamlessly integrating our platform-agnostic Advanced Threat Intelligence services into your security architecture, including SIEM, TIP and SOAR. -
16
RST Cloud
RST Cloud
RST Threat Feed, RST Report Hub, RST Noise Control, RST IoC Lookup, RST Whois API are a subscription-based services delivered by RST Cloud. RST Cloud collects actual knowledge about threats from all the available public TI sources. Normalise, filter, enrich and score it and gives it to your SOC and SecOps team, or directly put to your security solutions in ready-to-use format. RST Cloud includes: - Intelligence data from more than 250 sources and more than 250 000 indicators each day, - AI-powered threat report library, - IOC data formatted in a unified and standardised format, - Filtered results to excluded high-volume false positives, - Enriched IOCs which become more helpful in investigations, - Scored IOCs based on their severity and actuality, - Enriching and filtering False Positives services for SecOps teams, - Out-of-the-box integration with various SIEM, SOAR, TIP, NGFW solutions.Starting Price: $50/month -
17
Google Security Operations (SecOps) is an intelligence-driven, AI-powered security operations platform designed to help organizations detect, investigate, and respond to cyber threats at scale. Built as a cloud-native solution, Google SecOps unifies SIEM, SOAR, and threat intelligence into a single operational experience. The platform ingests and analyzes massive volumes of security telemetry with Google-level speed and scalability. Google SecOps applies Google’s curated and applied threat intelligence to uncover high-priority threats faster and with greater accuracy. Generative AI powered by Gemini enhances analyst productivity through natural language search, automated investigations, and contextual insights. Integrated automation and orchestration capabilities enable rapid response using playbooks and collaboration tools. Google Security Operations empowers security teams to reduce risk, improve response times, and modernize their SOC operations.
-
18
ARIA ADR
ARIA Cybersecurity Solutions
ARIA Advanced Detection and Response (ADR) is an automated AI SOC solution purpose-built with the capabilities of seven security tools — including SIEMs, IDS/IPSs, EDRs, Threat Intel tools, NTAs, UEBAs, and SOARs. With this single, comprehensive solution organizations will no longer have to settle for limited threat surface coverage or struggle to integrate and maintain disparate tools at substantial cost and little return. ARIA ADR’s machine learning-powered threat models, guided by AI, can find and stop the most harmful network-borne threats such as ransomware, malware, intrusions, zero-day attacks, APTs and more—in just minutes. This is a powerful advantage over most traditional security operations approaches that surface more noise than threats and require highly-trained security operations staff. There is also a cloud-based version of ARIA ADR which is a great entry level option for organizations. -
19
OpenText Core EDR
OpenText
OpenText Core EDR is an all-in-one endpoint detection and response solution that unifies endpoint protection, SIEM (security information and event management), SOAR (security orchestration, automation, and response), alert triage, and vulnerability assessment into a single platform, eliminating the need to manage disparate security tools. It uses a lightweight agent with pre-configured policies, enabling deployment in minutes and simplifying management across devices without complex scripting. By correlating endpoint, network, and identity events in real time, built-in SIEM and SOAR playbooks surface suspicious behavior and automatically guide containment, remediation, and investigation actions. Continuous, global threat intelligence powers real-time monitoring, helping detect malware, ransomware, zero-day attacks, and other advanced threats before they spread, and enabling rapid isolation or remediation of compromised endpoints. -
20
LMNTRIX
LMNTRIX
LMNTRIX is an Active Defense company specializing in detecting and responding to advanced threats that bypass perimeter controls. Be the hunter not the prey. We think like the attacker and prize detection and response. Continuous everything is the key. Hackers never stop and neither do we. When you make this fundamental shift in thinking, you start to think differently about how to detect and respond to threats. So at LMNTRIX we shift your security mindset from “incident response” to “continuous response,” wherein systems are assumed to be compromised and require continuous monitoring and remediation. By thinking like the attacker and hunting on your network and your systems, we allow you to move from being the prey to being the hunter. We then turn the tables on the attackers and change the economics of cyber defense by shifting the cost to the attacker by weaving a deceptive layer over your entire network – every endpoint, server and network component is coated with deceptions. -
21
Radware Threat Intelligence
Radware
Radware’s Threat Intelligence Subscriptions complement application and network security with constant updates of possible risks and vulnerabilities. By crowdsourcing, correlating and validating real-life attack data from multiple sources, Radware’s Threat Intelligence Subscriptions immunize your Attack Mitigation System. It provides real-time intelligence for preemptive protection and enables multi-layered protection against known and unknown vectors and actors as well as ongoing and emergency filters. Radware’s Live Threat Map presents near real-time information about cyberattacks as they occur, based on our global threat deception network and cloud systems event information. The systems transmit a variety of anonymized and sampled network and application attacks to our Threat Research Center and are shared with the community via this threat map. -
22
OpenText Enterprise Security Manager
OpenText
OpenText™ Enterprise Security Manager (ESM) is a robust Security Information and Event Management (SIEM) solution designed to provide comprehensive real-time threat detection and automated response. It features an industry-leading correlation engine that alerts analysts instantly to threat-correlated events, dramatically reducing the time required to detect and respond to cyber threats. ESM integrates native Security Orchestration, Automation, and Response (SOAR) capabilities, enabling organizations to streamline their security operations and lower total cost of ownership. With the ability to analyze over 100,000 events per second and support more than 450 event sources, it delivers enterprise-wide event visibility and enhanced threat intelligence. The platform’s scalable architecture supports customization through rulesets, dashboards, and reports tailored to unique security needs. It also offers multi-tenancy capabilities for centralized management across distributed business units. -
23
BloxOne Threat Defense
Infoblox
BloxOne Threat Defense maximizes brand protection by working with your existing defenses to protect your network and automatically extend security to your digital imperatives, including SD-WAN, IoT and the cloud. It powers security orchestration, automation and response (SOAR) solutions, slashes the time to investigate and remediate cyberthreats, optimizes the performance of the entire security ecosystem and reduces the total cost of enterprise threat defense. The solution turns the core network services you rely on to run your business into your most valuable security assets. These services, which include DNS, DHCP and IP address management (DDI), play a central role in all IP-based communications. With Infoblox, they become the foundational common denominator that enables your entire security stack to work in unison and at Internet scale to detect and anticipate threats sooner and stop them faster. -
24
ThreatStryker
Deepfence
Runtime attack analysis, threat assessment, and targeted protection for your infrastructure and applications. Stay ahead of attackers and neutralize zero-day attacks. Observe attack behavior. ThreatStryker observes, correlates, learns and acts to protect your applications and keep you one step ahead of attackers. Deepfence ThreatStryker discovers all running containers, processes, and online hosts, and presents a live and interactive color-coded view of the topology. It audits containers and hosts to detect vulnerable components and interrogates configuration to identify file system, process, and network-related misconfigurations. ThreatStryker assesses compliance using industry and community standard benchmarks. ThreatStryker performs deep inspection of network traffic, system, and application behavior, and accumulates suspicious events over time. Events are classified and correlated against known vulnerabilities and suspicious patterns of behavior. -
25
Rapid7 Incident Command
Rapid7
Rapid7 Incident Command is an AI-powered next-generation SIEM designed to deliver unified visibility and faster threat response across modern attack surfaces. It brings together logs, telemetry, asset context, and threat intelligence into a single, actionable view across cloud, SaaS, endpoints, and hybrid environments. Incident Command uses AI-driven behavioral detections and alert triage to cut through noise and surface the threats that matter most. Every alert is enriched with exposure, vulnerability, asset risk, and third-party intelligence to guide decisive action. Built-in SOAR automation and guided AI response workflows help reduce dwell time and accelerate containment. The platform supports advanced investigations with natural language search, attack path reconstruction, and MITRE ATT&CK alignment. Rapid7 Incident Command enables security teams to scale their SOC with speed, clarity, and confidence. -
26
Proofpoint Emerging Threat (ET) Intelligence
Proofpoint
Proofpoint ET Intelligence delivers the most timely and accurate threat intelligence. Our fully verified intel provides deeper context and integrates seamlessly with your security tools to enhance your decision-making. Knowing what types of threats exist is no longer enough to protect your people, data, and brand. Emerging Threat (ET) intelligence helps prevent attacks and reduce risk by helping you understand the historical context of where these threats originated, who is behind them, when have they attacked, what methods they used, and what they're after. Get on-demand access to current and historical metadata on IPs, domains, and other related threat intelligence to help research threats and investigate incidents. In addition to reputation intel, you get condemnation evidence, deep context, history, and detection information. It's all searchable in an easy-to-use threat intelligence portal that includes: Trends and timestamps of when a threat was seen and the associated category. -
27
Cequence Security
Cequence Security
Start analyzing and protecting your APIs with passive, inline or API-based integration with any existing network component – API gateway, proxy, CDN or ingress controller. Predefined policies, fine-tuned using threat patterns observed in protecting billions of API transactions per day delivers unmatched, out-of-the-box protection. A rich user interface and an open, API-based architecture enables integration with threat intelligence feeds, CI/CD framework tools, other security components, and SIEM/SOAR/XDR solutions. Patented ML-based analysis eliminates JavaScript and SDK integration pen-alties such as extended development cycles, slow page loads and forced mobile-app upgrades. ML-based analysis generates a unique Behavioral Fingerprint to determine malicious intent and continually tracks attackers as they retool. -
28
NESCOUT Cyber Threat Horizon
NESCOUT
NETSCOUT Cyber Threat Horizon is a real-time threat intelligence platform designed to provide visibility into the global cyber threat landscape, including DDoS attack activity. Leveraging data from NETSCOUT's ATLAS (Active Threat Level Analysis System), it offers insights into traffic anomalies, attack trends, and malicious activities observed across the internet. The platform empowers organizations to detect potential threats early by providing interactive visualizations, historical data analysis, and geolocation-based attack mapping. With its ability to track emerging threats and DDoS events as they unfold, NETSCOUT Cyber Threat Horizon is an invaluable tool for network administrators and security professionals seeking to enhance situational awareness and preemptively address risks. -
29
Securonix Unified Defense SIEM
Securonix
Built on big data, Securonix Unified Defense SIEM combines log management, user and entity behavior analytics (UEBA), and security incident response into a complete, end-to-end security operations platform. It collects massive volumes of data in real-time, uses patented machine learning algorithms to detect advanced threats, and provides artificial intelligence-based security incident response capabilities for fast remediation. The Securonix platform automates security operations while our analytics capabilities reduces noise, fine tunes alerts, and identifies threats both inside and out of the enterprise. The Securonix platform delivers analytics driven SIEM, SOAR, and NTA, with UEBA at its core, as a pure cloud solution without compromise. Collect, detect, and respond to threats using a single, scalable platform based on machine learning and behavioral analytics. With a focus on outputs, Securonix manages the SIEM so you can focus on responding to threats. -
30
Defused
Aves Netsec
Our deception product Defused is a SaaS cyber deception platform used to deploy and manage deception and moving target defense capabilities in your on-premise & cloud networks. Our attacker deception technology enables security teams to set up high-precision deception decoy sensors to know when threats are present in your network and detect cyber attackers without the hassle of a huge setup. Our deception platform serves as SaaS, enabling easy fleet management over even highly distributed environments. You download and configure a virtual machine on your local or cloud network which automatically deploys our deception decoys into that network. The deception decoys are connected to a central management dashboard, running in the cloud, and will transmit any attacker activity as security alerts into the cloud dashboard (using a one-way connection.) Exploit detection against emerging & unpatched vulnerabilities. -
31
ipdata
ipdata
Lookup the location of any IP Address to localize your website content, analyze logs, enrich forms, target ads, enforce GDPR compliance, perform redirections, block countries and more. We provide a fast, highly available IP Geolocation API backed by accurate data. Locate your website visitors by IP Address with city and postal code granularity. Check if an IP Address is listed in any of 200+ OSINT Threat Feeds instantaneously. Detect anonymous users to protect your business from fraud and abuse. Get the AS Organization and number of any IP Address. Determine whether an IP Address belongs to an ISP, Datacenter/Hosting or Business. We update hundreds of data sources roughly every 15 minutes. We help you prevent fraud on your ecommerce store. Stop fake account signups on your SaaS or App. Manage GDPR and CCPA regulatory compliance. Localize or fence your website's content based on a user's location and analyze logs and website traffic.Starting Price: $10 per month -
32
Netwrix Threat Manager
Netwrix
Threat detection software from Netwrix to detect and respond to abnormal behavior and advanced attacks with high accuracy and speed. IT infrastructures are getting more complex and the volume of sensitive information stored there is skyrocketing. At the same time, the threat landscape is evolving rapidly, with attacks becoming more sophisticated and more costly. Improve your threat management processes and know about anything suspicious happening in your network, whether it’s an external attack or an insider threat, with real-time alerts delivered via email or mobile notifications. Maximize the value of your investments and enhance security across the IT ecosystem by sharing data between Netwrix Threat Manager and your SIEM and other security solutions. Respond immediately upon threat detection by taking advantage of the extensive catalog of preconfigured response actions, or by integrating Netwrix Threat Manager with your own business processes using PowerShell or webhook facilities. -
33
Securonix SOAR
Securonix
As the attack surface expands, there is a shortage of skilled security personnel to secure businesses and keep the attackers at bay. Rapid response is essential to mitigate the risks of cybersecurity threats, but disparate security tools are cumbersome for security teams to manage, costing time and effort. Securonix Security Orchestration, Automation, and Response (SOAR) helps security operations teams improve their incident response times by providing automation that adds context and suggesting playbooks and next steps to guide analysts. SOAR optimizes orchestration by streamlining incident response with built-in case management, integrations covering over 275 applications, and seamless access to your SIEM, UEBA, and network detection and response (NDR) solutions in a single pane of glass. -
34
The market-leading SIEM delivers comprehensive visibility, empowers accurate detection with context, and fuels operational efficiency. Unmatched, comprehensive visibility by seamlessly ingesting, normalizing, and analyzing data from any source at scale enabled by Splunk's data-powered platform with assistive AI capabilities. Utilize risk-based alerting (RBA) which is the industry’s only capability from Splunk Enterprise Security that drastically reduces alert volumes by up to 90%, ensuring that you're always honed in on the most pressing threats. Amplify your productivity and ensure the threats you're detecting are high fidelity. Native integration with Splunk SOAR automation playbooks and actions with the case management and investigation features of Splunk Enterprise Security and Mission Control delivers a single unified work surface. Optimize mean time to detect (MTTD) and mean time to respond (MTTR) for an incident.Starting Price: Free
-
35
Cyber Triage
Sleuth Kit Labs
Fast & Affordable Forensics for Incident Response. Automated incident response software for fast, comprehensive, and easy intrusion investigations. An alert is generated from IDS or SIEM. An endpoint investigation is started from SOAR manually. Cyber Triage is deployed to the endpoint to collect data. Analyst uses Cyber Triage data to find evidence and make decisions. Manual incident response is slow, leaving the entire organization at the intruder’s mercy. By automating every phase of the endpoint forensics process, Cyber Triage ensures state-of-the-art remediation speed. Cyber threats are constantly evolving, and manual incident response can be inconsistent and incomplete. Always operating on the latest threat intelligence, Cyber Triage scours every relevant corner of a compromised endpoint. Forensic tools are often confusing, with features not needed for intrusions. Cyber Triage’s intuitive interface allows even junior staff to analyze data and assemble reports.Starting Price: $2,500 -
36
NetkaView Logger (NLG)
Netka System
Netka System offers advanced RegTech, OpsTech, and AI-powered IT security solutions, with NetkaView Logger (NLG) as one of its flagship products. NLG centralizes logs from all technologies into a single platform, enabling SIEM, SOAR, and IT observability functions. With built-in threat intelligence and deep packet inspection (DPI), organizations can detect and hunt threats in real time while ensuring compliance with Thailand’s Computer-related Crime Act 2017 and other data privacy regulations. The platform also provides real-time visibility into IT environments, helping teams identify risks, optimize performance, and maintain compliance. Netka’s offerings include both cloud-based and appliance-based deployments, giving businesses flexibility in scaling and managing their IT operations. By combining centralized log management with proactive defense, Netka helps organizations maximize security and efficiency.Starting Price: $149.99/month -
37
CardinalOps
CardinalOps
The CardinalOps platform is an AI-powered threat exposure management solution designed to provide organizations with an integrated view of prevention and detection controls across endpoint, cloud, identity, network, and more. It aggregates findings from misconfigurations, unsecured internet-facing workloads, missing hardening controls, and gaps in detection or prevention to give full visibility of exposures and prioritize actions based on business context and adversary tactics. The system continuously maps detections and controls to the MITRE ATT&CK framework to assess coverage depth and identify broken, noisy, or missing detection rules, while also generating deployment-ready detection content customized to each environment via native API integration with major SIEM/XDR tools such as Splunk, Microsoft Sentinel, IBM QRadar, and others. Through its automation and threat intelligence operationalization features, it helps security teams remediate exposure faster. -
38
Palo Alto Networks AutoFocus
Palo Alto Networks
Tomorrow's operations depend on unrivaled threat intelligence, today. Power up investigation, prevention and response with AutoFocus. Palo Alto Networks, provider of the industry-leading next-generation firewall, has made the world’s highest-fidelity repository of threat intelligence, sourced from the largest network of sensors, available for any team or tool to consume. AutoFocus™ contextual threat intelligence service is your one-stop shop for threat intelligence. Your teams will receive instant understanding of every event with unrivaled context from Unit 42 threat researchers, and you can embed rich threat intelligence in analyst’s existing tools to significantly speed investigation, prevention, and response. Get unique visibility into attacks crowdsourced from the industry’s largest footprint of network, endpoint, and cloud intel sources. Enrich every threat with the deepest context from worldrenowned Unit 42 threat researchers. -
39
Leviathan Lotan
Leviathan Security Group
Lotan™ provides your enterprise with the unique capability to detect attacks earlier, and with greater confidence. The fragility of exploits in the face of modern countermeasures and environment heterogeneity often leads to application crashes. Lotan analyzes these crashes to detect the attack and aid the response. Lotan collects crashes using either a simple registry change on Windows, or a small userland application for Linux. A RESTful API allows you to share evidence and conclusions with your existing Threat Defense and SIEM solutions. The API provides insight into each step of Lotan's workflow, including detailed information required to understand and respond to the threat rapidly. Lotan greatly increases the accuracy, rate, and speed with which threats are detected, and impedes the ability of adversaries to operate undetected within your network. -
40
Ipregistry
Ipregistry
Understand your audience and act upon—locate visitors by IP address, enrich forms, target mobile users, detect and prevent online fraud, analyze logs, or perform geo IP based redirections. Ipregistry is a trusted and in-depth IP Geolocation and Threat detections source of information that can benefit publishers, ad networks, retailers, financial services, e-commerce stores and more. Our products produce insights that can be used to personalize content for users, customers or leads in a non-intrusive manner, based on their currency, location, time zone, company or carrier details. These insights can also be leveraged to deliver targeted advertising, control the distribution of digital media but also prevent online fraud by detecting malicious activities: requests from hosting nodes, users using Tor, public proxies or users reported as abusers and attackers in 220+ OSINT threat feeds.Starting Price: $1.8 per 14.409 lookups -
41
Resecurity
Resecurity
Resecurity Risk is dedicated threat monitoring platform for brands, their subsidiaries, assets, and executives. Launch in 24 hours just import your unique digital identifiers and get close to real-time updates of over 1 Petabyte of actionable intelligence impacting you now. Security information and event management (SIEM) tools can help identify and highlight many critical events at a glance if all active threat vectors are available to be ingested within the platform and are from verified sources with accurate risk scoring. Resecurity Risk an omni-directional threat product which would usually require multiple vendors to resolve. Integrate available security solutions to actualize the risk score of your enterprise footprint. Driven by your data, powered by Context™. Holistic approach to piracy and counterfeit monitoring for various industry verticals. Prevent illicit distribution and use of your products, using actionable intelligence. -
42
RevBits Deception Technology
RevBits
RevBits Deception Technology elevates the threat-hunting capability for security administrators by offering sophisticated architecture in the deception/honeypot marketplace. By deploying real server-based honeypots in a resource-light environment - distinguishing between real and fake servers is virtually impossible. Adding the ability to plant fake honey drop credentials throughout the network, breach points are illuminated and isolated. RevBits Deception Technology is designed to attract, capture, and hold the malicious act or malicious software that gains entry into the network and probes looking for valuable assets. RevBit's deployment of real server-based decoys makes detection between real and malicious software straightforward. Using RevBits integrated solutions allows for the exchange of intelligence between modules, based on standardized logging, to improve detection, response time, and protection of network assets including honeypots. -
43
MaxMind
MaxMind
MaxMind GeoIP2 offerings identify the location and other characteristics of Internet users for a wide range of applications including content personalization, fraud detection, ad targeting, traffic analysis, compliance, geo-targeting, geo-fencing and digital rights management. GeoIP2 Precision Services provide you with our most accurate data without having to worry about hosting data on your servers or deploying updates. Accessed through an API or a manual file upload, our Precision Service offerings provide you with the most up-to-date data available. MaxMind's GeoIP2 Databases provide IP intelligence data for high volume environments. By hosting our databases locally, you eliminate any network latency and per-query charges. -
44
Lakera
Lakera
Lakera Guard empowers organizations to build GenAI applications without worrying about prompt injections, data loss, harmful content, and other LLM risks. Powered by the world's most advanced AI threat intelligence. Lakera’s threat intelligence database contains tens of millions of attack data points and is growing by 100k+ entries every day. With Lakera guard, your defense continuously strengthens. Lakera guard embeds industry-leading security intelligence at the heart of your LLM applications so that you can build and deploy secure AI systems at scale. We observe tens of millions of attacks to detect and protect you from undesired behavior and data loss caused by prompt injection. Continuously assess, track, report, and responsibly manage your AI systems across the organization to ensure they are secure at all times. -
45
Proofpoint Identity Threat Defense
Proofpoint
In an ever-changing hybrid world, your organization depends on its employees, their virtual identities, and the endpoints they operate on to build and protect its assets. Threat actors have found unique ways to move laterally across your cloud environments by exploiting such identities. You need an innovative and agentless identity threat detection and response solution to discover and remediate modern identity vulnerabilities—a key part of today’s attack chain. Proofpoint Identity Threat Defense, previously Illusive, gives you comprehensive prevention and visibility across all your identities so you can remediate identity vulnerabilities before they become real risks. You can also detect any lateral movements in your environments and activate deception to ensure threat actors are stopped in action before they gain access to your corporate assets. It doesn’t get better than knowing you can prevent modern identity risks and stop real-time identity threats in action, all in one place. -
46
CyberTrap
CyberTrap
Enable the immediate detection of attacks with CyberTrap’s deception technology. Our threat detection solutions deliver immediate detection of attacks, luring, deceiving, and entrapping hackers. Traditional cybersecurity solutions are unable to prevent Advanced Persistent Threats (APTs) and targeted attacks, allowing cyber criminals to exploit vulnerabilities and gain access to organizations’ data, applications, and systems without being detected. In contrast, CyberTrap helps organizations outsmart cyber attackers with advanced threat intelligence and our proprietary deception technology. Identify snoopers before they reach production. As soon as someone interacts with our strategically placed lures, it generates a true positive result, instantly flagging potential threats. This proactive approach ensures that suspicious activities are recognized and addressed in real time. Divert intruders away from authentic assets. -
47
LevelBlue Open Threat Exchange
LevelBlue
LevelBlue Open Threat Exchange (OTX) is a comprehensive security information and event management (SIEM) platform designed to provide real-time visibility and intelligence for network and security operations. OTX enables organizations to detect and respond to threats faster, offering capabilities such as asset discovery, vulnerability scanning, and log management. With an open architecture, OTX integrates with a wide range of security tools and data sources, providing a unified approach to threat detection and response. It's designed to enhance both operational efficiency and security posture, making it suitable for organizations of all sizes looking to streamline their security operations. -
48
Extend your security intelligence from local network to global cyberspace. Get in-depth, up-to-date global knowledge about specific threats and attack sources, which can be difficult to obtain if you only have access to information within your own networks. ESET Threat Intelligence data feeds utilize widely supported STIX and TAXII formats, which makes it easy to integrate with existing SIEM tools. Integration helps to deliver the latest information on the threat landscape to predict and prevent threats before they strike. ESET Threat Intelligence features a full API that is available for automation of reports, YARA rules and other functionalities to allow for integration with other systems used within organizations. These allow organizations to set up custom rules to obtain company-specific information that security engineers are interested in. Organizations receive valuable details such as the number of times specific threats have been seen worldwide.Starting Price: $132
-
49
Threat Intelligence Platform
Threat Intelligence Platform
Threat Intelligence Platform combines several threat intelligence sources to provide in-depth insights on threat hosts and attack infrastructure. Correlating threat information from various feeds with our exhaustive in-house databases, a result of 10+ years of data crawling, the platform performs real-time host configuration analyses to come up with actionable threat intelligence that is vital in detection, mitigation, and remediation. Find detailed information about a host and its underlying infrastructure in seconds through the Threat Intelligence Platform web interface. Integrate our rich data sources into your systems to enrich results with additional threat intelligence insights. Integrate our capabilities into existing cybersecurity products, including cyber threat intelligence (CTI) platforms, security information and event management (SIEM) solutions, digital risk protection (DRP) solutions, and more.Starting Price: $12.5 per month -
50
IP-API.com
IP-API.com
We update our database as soon as we have new information about an IP block. For each API request, you will always have the most accurate location data, without having to worry about updating a local database. IP-API has been running since 2012 and we are now providing one of the most popular and reliable IP Geolocation API. We do not allow commercial use of the free endpoint. Please see our pro service for SSL access, unlimited queries, usage statistics and commercial support. With dedicated servers in US, EU and APAC, a network based on Anycast technology, and highly optimized software we achieve real response times of under 50 milliseconds in most parts of the world. Our endpoints are limited to 45 HTTP requests per minute from an IP address. If you go over this limit your requests will be throttled (HTTP 429) until your rate limit window is reset.
