Threat intelligence
Campaign and indicator context is matched against your inventory, so intelligence arrives as "this affects these four assets" rather than a feed nobody reads.
campaigns currently matching the demo tenant's surface
What threat intelligence actually does
Surface matching
Indicators are resolved against your own assets before they are shown. Unmatched intelligence stays in the library.
Campaign profiles
Actor type, targeting pattern, observed techniques and how those techniques interact with your live paths.
Look-alike watch
Certificate transparency and registration monitoring for names that imitate your own.
Activity timeline
A single chronological record of intelligence, discovery and posture changes.
See it working on demo data
- Indicators are matched against your own inventory before they are shown to anyone.
- Campaign profiles state actor type, targeting pattern and which of your live paths the techniques touch.
- Look-alike watch monitors certificate transparency and registrations for names imitating your own.
Quiet Ledger
Invoice fraud crew that harvests supplier document portals, then re-issues payment instructions from look-alike domains.
- Actor type
- Financially motivated
- Targets
- Freight and customs brokerage
- First observed
- 2026-06-11
- Surface matches
- 3
| Indicator | Type | Campaign | Confidence | Matched asset |
|---|---|---|---|---|
| northfleet-invoices[.]co | domain | Quiet Ledger | high | supplier-docs.northfleet.io |
| nfg-supplier-portal[.]net | domain | Quiet Ledger | high | supplier-docs.northfleet.io |
| CN=fleet-ops-eu, O=Unverified | certificate | Quiet Ledger | medium | legacy-edi.northfleet.io |
Activity timeline
Intelligence, discovery and posture changes in one record.
northfleet-invoices[.]co resolved for the first time. Certificate transparency match on the supplier portal name.
supplier-docs.northfleet.io began answering on a second origin pool in eu-west-2.
Blast radius widened after the analytics role gained read on a fourth prefix.
Enforcement point deployed between the campus range and the depot gateway.
Deploy identity subject claim narrowed to 13 active repositories.
Yes. STIX/TAXII feeds and custom indicator lists are supported, and they go through the same surface-matching step as our own intelligence.
No. They stay in the library and are searchable. They are simply not pushed at anyone, because an unmatched indicator is not an event.
Actor type and targeting pattern are. We do not publish nation-state attribution, because we cannot evidence it to the standard that claim deserves.
Put threat intelligence against your own estate
A four-week proof of value connects one cloud account, your DNS and your identity provider, and ends with a written readout. Lodemark stays read-only throughout.
Illustrative product data. Nothing on this site performs a live scan.