Where this collector family fits
Threat-intelligence collectors add indicators, vulnerability context, adversary knowledge, reputation, and source-specific context to Nova. A source match supports investigation but does not prove malicious activity on its own.
- Indicator context and matching
- Vulnerability prioritization
- Adversary and technique context
- Reputation and investigation enrichment
Supported collectors in this family
Nova currently implements 17 collectors in this family. Each entry names the source and the customer outcome it supports.
- AbuseIPDB TI
- Adds AbuseIPDB TI context to Nova investigations for threat assessment, prioritization, and response planning.
- AlienVault OTX TI
- Adds AlienVault OTX TI context to Nova investigations for threat assessment, prioritization, and response planning.
- CISA Known Exploited Vulnerabilities
- Adds the CISA catalog of vulnerabilities known to be exploited for vulnerability prioritization.
- CrowdStrike Falcon TI
- Adds CrowdStrike Falcon TI context to Nova investigations for threat assessment, prioritization, and response planning.
- FIRST Exploit Prediction Scoring System
- Adds daily exploit-likelihood context for prioritizing exposed vulnerabilities.
- GreyNoise TI
- Adds GreyNoise TI context to Nova investigations for threat assessment, prioritization, and response planning.
- MISP TI
- Adds MISP TI context to Nova investigations for threat assessment, prioritization, and response planning.
- MITRE Enterprise ATT&CK
- Adds the public MITRE Enterprise ATT&CK knowledge base for technique, software, group, campaign, and relationship context.
- MalwareBazaar Threat Intelligence
- Adds MalwareBazaar Threat Intelligence context to Nova investigations for threat assessment, prioritization, and response planning.
- Mandiant Threat Intelligence
- Adds Mandiant Threat Intelligence context to Nova investigations for threat assessment, prioritization, and response planning.
- OpenCTI TI
- Adds OpenCTI TI context to Nova investigations for threat assessment, prioritization, and response planning.
- Recorded Future Threat Intelligence
- Adds Recorded Future Threat Intelligence context to Nova investigations for threat assessment, prioritization, and response planning.
- Shodan TI
- Adds Shodan TI context to Nova investigations for threat assessment, prioritization, and response planning.
- TAXII 2.1 TI
- Adds TAXII 2.1 TI context to Nova investigations for threat assessment, prioritization, and response planning.
- URLhaus Threat Intelligence
- Adds URLhaus Threat Intelligence context to Nova investigations for threat assessment, prioritization, and response planning.
- VirusTotal TI
- Adds VirusTotal TI context to Nova investigations for threat assessment, prioritization, and response planning.
- abuse.ch Feodo Tracker
- Adds the Feodo Tracker command-and-control address feed for focused outbound-traffic hunting.
How the evidence supports customer work
Nova keeps collected data linked to its source as it is used for asset inventory, cloud security, detection, investigation or Threat Hunting. Collecting data does not by itself prove a threat or authorize a response action.
Source coverage is not assumed to be complete. Nova keeps collection health, freshness, gaps, and partial results visible so teams can judge whether the evidence is suitable for the decision at hand.
Questions to answer during evaluation
- Which named sources are required for the use case, and which are optional context?
- What history, accounts, subscriptions, organizations, projects, or devices are available to the source product?
- What delay, volume, and missing-data conditions are acceptable for the intended decision?
- Which customer team owns source access, data interpretation, and ongoing health review?