Threat Intelligence Vendor Portal Access

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects network connections to known threat intelligence vendor portals. It specifically looks for HTTP traffic where the host header matches one of the specified domains: intel471.com, ke-la.com, recordedfuture.com, or flashpoint.io. This could indicate an analyst or automated system accessing threat intelligence resources.