Threat intelligence
Use curated indicators, inspect feed freshness, and distinguish intelligence matches from confirmed compromise.
Threat intelligence supplies indicators, actor context, and current threat activity to Guard's detection and risk workflows. An indicator match is an observation requiring context; it is not by itself proof that an asset is compromised.
Review intelligence
Open Intelligence → Feeds to inspect the last successful refresh, source version, indicator validity, and synchronization error. Feeds update continuously with sub-hour refresh coverage. The displayed ingestion time is separate from a source's publication time. A disconnected installation retains its last successfully imported data and marks freshness degraded; it does not report old data as current.
At Intelligence → Indicators, filter by ip, domain, url, or sha256, source, confidence, validity, and campaign. Open an indicator to see first seen, last seen, expiry, provenance, and linked detections. Hash values use SHA-256 hex; domains normalize case. A URL match is distinct from matching every resource on its domain.
Apply intelligence to protection
At Policies → Edge policy → Reputation, choose monitor or block for the configured confidence threshold and preview affected services. At Policies → Endpoint policy → Intelligence, choose supported indicator matching behavior. New feed content can change matches without a new policy revision; each detection retains the feed version and rule revision used to evaluate it.
Executors stop matching a locally known indicator after its recorded expiry. Withdrawal takes effect when the executor adopts the updated feed version. Historical matches retain their evaluation-time context. Create a temporary exception for the specific indicator and asset, with an owner and expiry, to preserve unrelated protection.
Investigate a match
Open Detections → Detection → Intelligence context. Compare process ancestry, connection direction, service logs, exposure, and other observations before requesting containment. Shared hosting and reassigned IPs can produce legitimate traffic to a listed address. Review related campaigns and risk, then collect evidence or open an incident.
Self-hosted feed synchronization uses outbound HTTPS and its own credential. It does not require a DDoS Connector. If the feed is stale, inspect Installation → Health → Feed synchronization, restore egress or credentials, and verify that executors have consumed the refreshed version. See environment settings.