Skip to main content
Before you trust an address that appears in your logs, a link in an email or a file someone sent you, you can check whether it has been reported. Threat Intelligence looks it up in the OneFirewall alliance, whose members report the threats they see, and tells you how risky it is.

​
What you can look up

As you type, the field names the kind of value it recognised. A value it cannot look up is marked Not something we can look up. Only IPv4 addresses are recognised, not IPv6 ones. Each kind of lookup needs its own Threat Intelligence licence (IP addresses, URLs, domains, files). A kind your organization does not have is shown with a lock; looking it up says that these lookups are not in your plan, and an Owner can click Acquire license to ask Aegister for it. Every role (Viewer, Security Officer, Owner) can run lookups.

​
Where to look it up

  • Perimeter Protection → Threat Intelligence in the side menu (app.aegister.com/perimeter-protection/threat-intelligence/): paste the value in the field and click Check, or drop a file on Or drop a file here, or choose one.
  • The home page: the search field at the top, Threat Intelligence: look up an IP, URL, domain or hash, opens the result directly. It is shown when your organization has the IP address licence.
  • The search palette (⌘K or Ctrl+K): type a value and pick Look up … in Threat Intelligence.
A file is never uploaded: your browser computes its SHA-256 fingerprint and only that is looked up. Very large files (over about 2 GB on a computer, 500 MB on a phone) cannot be read in a browser.
The page remembers your last six lookups under Recent, in this browser only. The address bar keeps the lookup (for example …/threat-intelligence/#ip?q=203.0.113.45), so you can send the link to a colleague who has access.

​
Read the result

Every result opens with the same verdict.

​
Crime score and threat level

The Crime score sums up how risky the value is. The bar below it places it on five levels: A sentence beside the score says how many times it was reported, by how many alliance members and since when, and for an IP address what it was reported for most often.

​
The facts

  • Reports: how many reports it received.
  • Alliance members: how many members reported it.
  • First reported and Last reported: when it was first and last seen.
For an IP address the verdict also shows Network (the autonomous system and its name), Domain and Located in (the country). For a file it shows its SHA-256, SHA-1 and MD5 fingerprints and its type. URLs, domains and files can also carry tags describing the threat.

​
The full report for an IP address

An IP address gets a full report below the verdict, with an index of its sections:
  • Score over time: how the crime score changed, with the lowest and highest values.
  • What it was reported for: the kinds of activity reported, the number of Suricata / Emerging Threats signatures it triggered and the MITRE ATT&CK tactics involved.
  • Techniques and defences: each MITRE ATT&CK technique (for example T1110), linked to the MITRE site, with How to defend against it when a defence is known.
  • Who reported it: the alliance members that reported it and Their sectors.
  • Where it was reported from: the countries the reports came from.
  • Seen by Aegister sensors: what Aegister’s own sensors (Cloud Defender, Threat Blocker) reported about this address: When, Source, Confidence and What was seen.
  • STIX indicators: machine-readable indicators for a SIEM or firewall, which you can download as a .json file.

​
When nothing is found

Nothing reported means the value has no reports in the alliance. That is not a guarantee: new threats are reported every day. If the lookup service does not answer in time, the page says The lookup did not answer: click Retry.

​
The PDF report

For an IP address, Report PDF at the top of the result opens a Threat Intelligence report in PDF: the crime score, the address’s network details, its score over time, the MITRE ATT&CK techniques, the reporting members and the STIX indicators. Attach it to a ticket or share it with someone who has no access to the console. Copy copies the value you looked up.

​
What to do next

Malicious addresses are handled for you by the Aegister services you have:
  • Threat Blocker blocks the hosts whose crime score is at or above your threshold, both attackers reaching in and hosts your devices try to reach, and reports the malicious addresses it sees to the alliance automatically. Its status page shows your threshold and the hosts it blocked.
  • Cloud Defender does the same for your web applications: requests from sources known for attacking are refused before they reach your site, and the attacks it sees are reported automatically. The Attackers tab of its status page shows the reputation of each source.
Then:
  • High or Critical and the address is not covered by those services: block it on your firewall or mail filter, and check your logs for other contacts with it.
  • Part of an incident: add it as an indicator when you notify the incident to ACN; the console checks it against Threat Intelligence for you.
  • Low, Medium or nothing reported: use your judgement. A low score or no report does not prove that a value is safe.