Threat Intelligence Sources

Configured threat intelligence sources for IP reputation analysis

AbuseIPDB

IP reputation database with abuse reports

⏳ Checking...

VirusTotal

Multi-engine malware detection platform

⏳ Checking...

AlienVault OTX

Open Threat Exchange pulse data

⏳ Checking...

GreyNoise

Internet noise and threat classification

⏳ Checking...

Spamhaus

DNSBL-based blocklist (free, no API key)

✅ Active (free)

URLhaus

Malware URL tracking (free, no API key)

✅ Active (free)
How It Works

When an event is captured, SIRIUS automatically queries all configured threat intelligence sources to correlate the source IP against known malicious activity databases.

  1. IP is extracted from the incoming request
  2. Query is sent to each configured source in parallel
  3. Results are aggregated and scored (0-100)
  4. Risk level is assigned: Critical / High / Medium / Low / Informational
  5. All results are cached to respect API rate limits
Configure API keys in Settings to enable premium threat intel sources.