MetaDefender Threat Intelligence is a cybersecurity service that aggregates and correlates technical threat indicators from sources including proprietary databases, global sandbox telemetry, open-source intelligence (OSINT), and live endpoints. It provides curated intelligence feeds containing contextualized indicators of compromise (IOCs) such as file hashes, IP addresses, domains, and URLs to detect malware, phishing campaigns, and adversary infrastructure. The intelligence is delivered via a REST API for on-demand lookups or through continual snapshot downloads of active indicators, with results formatted in JSON and including severity scores and confidence levels to support security operations.
The system uses machine learning for threat similarity searches and reputation checks against its artifact database. It integrates with sandbox technology for dynamic analysis of file execution behavior and provides allowed or blocked verdicts for files, detailing the reasons for a block. The service supports submitting suspicious files to a cloud environment for further evaluation using multiscanning with multiple anti-malware engines. This API-based functionality enables security teams to programmatically implement hash-based denylists, analyze malware trends, and evaluate network connections for threat hunting and incident response.
