Threat intelligence
We watch the threats. And your fleet.
orta follows 11 open threat feeds and checks every event on your hosts against them as it arrives. When a feed publishes something new, orta also looks back over the last hour of your traffic, so a connection made just before still raises an alert.
Matched in the stream
Binary hashes, addresses and URLs in command lines are checked before events are even stored.
Quiet by default
Alerts fire when your host acted: connected out or ran the file. Scanners knocking on the door only tag the event.
Looks back
Every 15 minutes, newly published addresses and domains are checked against the last hour of your network activity.
Feeds kept fresh
Each feed refreshes on its own schedule, from hourly to every 12 hours; the ATT&CK actor library daily.
Context for every match
Indicator quality score, source, malware family and the threat actor behind it.
Works with what you run.
Alerts go to
- Slack
- Telegram
- Jira
- Signed webhooks