News
eSentire Launches Open Source Threat Intelligence Aggregator
March 2016 by Marc Jacob
eSentire, Inc. announced Cymon, the world’s largest open source threat intelligence aggregator of its kind. Cymon ingests 180+ sources daily to track malware, phishing, botnets, spam, and more, adding over 20,000 unique IPs to its database every day.
eSentire’s Security Operations Center analysts and Professional Services groups have been using Cymon for security investigations since its beta launch in late 2014. To date, Cymon has logged more than 6 million IP addresses and more than 33.7 million security events. Source data is collected from a multitude of 180+ sources including publically available industry, government, and commercial threat intelligence feeds, VirusTotal, Phishtank, blacklists, antivirus vendor source reports, and eSentire’s own proprietary intelligence lists.
Main features of Cymon include:
• Open for public use
• Cymon database is fully searchable by IP, domain, URL, or hash
• Web interface provides a detailed timeline and events acquisition chart
• Threat reports – see historical IP data to support a forensic investigation
• Filters and alerts – get notified when employees, your company, or partners end up on a hacker’s target list
• Open APIs – a full set of REST APIs lets users integrate Cymon in their business processes
• Personalized dashboard for registered users
• Interface visualization provides macro and micro global heat map views
• Pastebin monitoring
• Cymon InterceptorTM, a Google Chrome plug-in (coming soon)
Coming this Spring, Cymon Interceptor is a Chrome browser plug-in that makes Cymon’s capabilities broadly available, providing protection for individuals’ personal devices.
Cymon’s malicious IP address queries are freely available to other threat intelligence researchers. For more information, or if you suspect that a specific IP address has a history of hosting malicious content or activity, query Cymon through its website: www.cymon.io, or follow @cymonbot on Twitter and request an IP scrub.
