Plans
Sign inThreat-actor profiles with infrastructure that updates every day, for the groups exploiting edge devices, Linux and ESXi. Everything is built from public sources and my own hunting, delivered as STIX 2.1 so it drops straight into OpenCTI, MISP or any TAXII client.
Early access: every plan is free while the library grows. Sign up, get a token, and tell me what's missing.
-
Free
€0
Anyone who wants to judge the work before paying for it.
- Public actor pages
- Sample actors as complete STIX 2.1 bundles: profile, live infrastructure and detection content
- Public detection rules (DRL 1.1)
- Newsletter and the annual threat review
- Delivery
- Download from the actor pages
- License
- Free to use with attribution
-
Researcher
Free during early access
Independent researchers, students and analysts working on their own.
- Every actor profile in the library
- Live actor infrastructure
- Monthly threat snapshot
- Delivery
- HTTPS download with a personal token
- License
- Personal, non-commercial use
-
Executive brief
Free during early access
CISOs and security managers who need the picture, not the indicators.
- Quarterly trend report with board-ready slides
- Monthly snapshot: what changed and what to do about it
- Annual review
- Delivery
- PDF and slides on your account page
- License
- Internal use within one organization
-
Organization
Free during early access
SOC and CTI teams that want the library in their own platform.
- Every actor profile, with relationships and sources
- Live infrastructure, re-checked daily
- Executive brief included
- New actors arrive in your existing feeds automatically
- Delivery
- TAXII 2.1 and HTTPS download, several tokens
- License
- Internal use within one organization
-
Organization + Detection
Free during early access
Teams that also want deployable detection content.
- Everything in Organization
- Tested YARA, Sigma and Suricata rules per actor
- SIEM hunting queries (Splunk, Elastic, Sentinel)
- Test evidence and known false positives for every rule
- Delivery
- TAXII 2.1 and HTTPS download, plus a detection collection
- License
- Internal use within one organization
-
MSSP
Free during early access
Managed security providers protecting several client organizations.
- Everything in Organization and the Detection add-on
- Use across all of your clients
- Separate tokens per client or platform
- Delivery
- TAXII 2.1 and HTTPS download
- License
- Redistribution to your clients
How access works
- Pick a plan and create an account with your email and a password.
- On your account page, create an API token for each platform you'll connect. You can rotate or revoke them any time, and download your reports there.
- Connect your platform using the feed documentation: one TAXII feed brings in every actor and everything your plan includes, and new actors appear without any changes on your side.
Questions
Where does the data come from?
Public reporting, open scanning data and my own infrastructure hunting. Sources are cited on every profile. Infrastructure indicators carry a confidence value and an expiry date, because servers change hands.
Can I try it first?
Yes: the free sample actors are complete bundles, identical in format to the paid feeds. Browse the actors.
What happens after early access?
Paid plans will be announced well in advance, by email to everyone who signed up. Nothing renews or charges automatically, and data you already imported stays usable under your license.
Anything else?
Write to feeds@knownexploited.com.