Rapid7 Threat Intelligence

Rapid7 offers a comprehensive Threat Intelligence platform as an integral part of the Rapid7 Insight Platform ecosystem. Its purpose is to provide organizations with up-to-date, operational, and strategic threat intelligence that supports security decisions and operational activities. The platform combines threat data with advanced analytics, external monitoring, contextual IOC enrichment, and risk management, including supply chain risk management.

Threat Command
Threat Command is a module for monitoring and managing external threats (External Threat Intelligence) that provides insight into cybercriminal activity on the internet, the dark web, hacker forums, social media, and pastebin channels. The platform actively searches for threats related to brands, domain names, user accounts, credential leaks, typosquatting, and malicious infrastructure. Threat Command not only detects these threats, but also allows corrective action to be taken from a single interface. This provides proactive protection for the organization’s reputation and reduces risk before an incident occurs.

Threat Intelligence Platform (TIP)
Rapid7’s Threat Intelligence Platform serves as a central intelligence management system, enabling the aggregation, correlation, prioritization, and distribution of threat information. TIP centralizes and operationalizes thousands of intelligence sources to streamline investigation and proactively block threats.
It enables the integration of external data (e.g., open source feeds, commercial TI, Threat Command information) with internal organizational data such as logs, alerts, and incidents. TIP supports CTI, SOC, and IR teams in threat analysis, allowing them to create detection rules, playbooks, and strategic reports. It also facilitates cross-team collaboration by automating information sharing and response decisions.

Vulnerability Risk Analyzer
Every organization faces a large number of CVEs and vulnerabilities in its network and infrastructure, but patching them is a resource-intensive and time-consuming task. The Vulnerability Risk Analyzer module combines threat data with information about vulnerabilities detected in the IT/OT environment. Through integration with InsightVM (Rapid7 Vulnerability Management), it allows you to link known threats to actual vulnerabilities in your organization. This makes it easier to prioritize remediation efforts based on the real-world risk context (e.g., active exploitation by known actors). This module increases the effectiveness of vulnerability management through an integrated IT + VM approach and allows you to focus your resources on the most critical gaps.

Third Party Risk Intelligence
The Third Party Risk Intelligence module enables monitoring of the risk level and exposure of partners, suppliers, and service providers in the supply chain. Rapid7 analyzes data from open sources, the dark web, and recorded incidents to assess the cybersecurity reputation of contractors. Organizations can track changes in supplier risk over time, receive alerts about significant threats (e.g., data leaks, malware infections), and make informed decisions about cooperation or additional security requirements.