CTI Feed

Keep your infrastructure off the radar

The Secutec CTI Feed makes you invisible to scanners. Harder to attack.

Before launching an attack, cybercriminals scan the internet for exposed systems, vulnerable software and potential entry points. Search engines such as Shodan make this information easily accessible, allowing attackers to identify potential targets without extensive investigation.

Reduce your visibility to attackers.

Traditional security solutions focus on detecting and blocking threats. But what if you could prevent attackers from discovering your infrastructure in the first place?

By blocking known internet scanners and malicious IP addresses directly at firewall level, you can disrupt reconnaissance before an attack even begins.

The Secutec CTI Feed adds an intelligence-driven layer to your existing firewall, helping you:

Become invisible to known scanners:
Prevent identified scanning infrastructure from collecting information about your systems, reducing the likelihood of being indexed and targeted.
Disrupt attacks earlier:
Block known malicious sources before they can investigate your environment or establish connections.
Stay ahead of evolving threats:
Benefit from threat intelligence refreshed every four hours, without manually maintaining extensive blocklists.

The less attackers can discover, the harder it becomes to target your organization.

Collect

SIAM gathers intelligence on known scanners, malicious IP addresses, botnets, command-and-control infrastructure and fraudulent domains.
Consolidate

Intelligence from multiple sources is combined into actionable IP and domain-based feeds.
Update

The feed is refreshed every four hours to reflect newly identified threats.
Block
Supported firewalls automatically apply the intelligence to block matching inbound and outbound connections.
Known good scanners
Known bad scanners
Custom lists based on your infrastructure

Want to know more?

What does the Secutec CTI Feed protect against?

Six complementary intelligence feeds provide targeted protection:

Incoming traffic from scanners (IP): Blocks reconnaissance and scanning activity.
APT/Botnet/C&C (IP) – IN & OUT: Detects and prevents communication with Advanced Persistent Threats and command-and-control infrastructure.
Bad Actors (IP) – IN & OUT: Identifies both inbound and outbound connections to known malicious actors.
Belgian CERT Intelligence (IP) – IN & OUT: Leverages authoritative national threat intelligence to block high-priority threats.
FQDN – APT/Botnet/Bad Actors/BE CERTs – OUT: Prevents data exfiltration and access to harmful domains.
FQDN – advertisement scams – OUT: Stops connections to domains linked with fraudulent advertising and online scams.

Proactive protection:

Reduce reconnaissance and prevent connections to known threats before they reach your systems.
Multi-source intelligence:

Benefit from international intelligence providers, Secutec's research and Belgian CERT sources.
Continuous updates:

Fresh intelligence published every four hours.
Easy integration:

Strengthen supported firewalls without replacing your existing security architecture.
Threat visibility:

Monitor blocked connections through your firewall's logging capabilities.
Broader security integration:

The CTI Feed also contributes to Secutec's Active Threat Hunting solution within SecureSIGHT.