Criminal IP, a cyber threat intelligence platform, has been integrated with Securonix’s threat intelligence operations platform, ThreatQ.
ThreatQ is a Threat Intelligence Platform (TIP) that centralizes, aggregates, and prioritizes threat data from multiple sources, serving as a core system for managing investigation and response workflows within security operations.
With this integration, organizations can directly leverage Criminal IP’s external IP-based threat intelligence within the ThreatQ environment.
This enables security teams to apply real-time threat context seamlessly across analysis and response processes, without switching between external tools or consoles.
Expanding Real-Time Threat Intelligence in ThreatQ
Criminal IP’s threat intelligence is embedded into the ThreatQ platform, automatically enriching collected IP indicators with contextual analysis.
Threat data ingested into ThreatQ is enhanced in real time via the Criminal IP API with the following intelligence:
- Maliciousness scoring and risk classification
- Detection of anonymization infrastructure (VPN, Proxy, Tor)
- Exposure of remote access services
- Open ports and service information
- Known vulnerabilities and historical abuse records
By combining this data with existing indicators, organizations gain real-world, exposure-based threat context that goes beyond traditional IOC-level analysis.
Automated Threat Enrichment and Workflow Efficiency
Criminal IP integrates with ThreatQ’s Orchestrator to provide automated threat intelligence enrichment as indicators are ingested.
Through pre-configured workflows, newly generated IP indicators trigger automated API calls to Criminal IP, retrieving the latest intelligence and enriching ThreatQ data accordingly.
This continuous process enables:
- Up-to-date threat context without manual lookups
- Consistent evaluation of indicators
- Faster triage at the early stages of analysis
In addition, analysts can perform on-demand Criminal IP lookups directly within the ThreatQ interface, allowing immediate access to detailed intelligence without leaving the platform.
Intelligence-Driven Analysis and Response Optimization
Criminal IP’s intelligence integrates with ThreatQ’s scoring and analysis framework, enabling more precise threat evaluation tailored to each organization’s environment.
This allows security teams to prioritize high-risk indicators more effectively, rather than processing large volumes of data without context.
By providing infrastructure-level exposure data and relationships between IPs, Criminal IP also enables analysis at the attack flow level, rather than isolated event-based investigation.
🔗 View Integration Documentation
Advancing Intelligence-Driven Threat Operations
Through the integration of Criminal IP and ThreatQ, organizations can operationalize threat intelligence as a core component of their security workflows rather than treating it as reference data.
This integration supports:
- Automated intelligence enrichment
- Workflow-driven analysis processes
- Precise, context-based prioritization
As a result, security teams can reduce repetitive manual tasks and focus on threats that have a tangible impact on their organization.
Criminal IP will continue to expand integrations with global security platforms to ensure that threat intelligence is effectively operationalized across real-world security environments.