Feedly’s Cyberattack Intel Agent enables you to be the first to know about relevant attacks, spot patterns, and prioritize your analysis. It's powered by the Real-Time Threat Graph, providing you with current and relevant attack context in a single view, enabling quick analysis and custom reporting. It collects data from over 10,000 OSINT sources, including SEC filings and regional stock exchange reports.

What makes an effective Cyberattack Intel Agent view? We asked Feedly Threat Intelligence Advisors to provide their favorite and most useful configurations and explain how clients use them to protect their organizations.

Example 1: Trending cyberattacks

Most CISOs want to be aware of what's going on, not just in their industry, but in cybersecurity in general. This trending cyberattacks view ensures that you don't miss any emerging attacks, or even those that are making headlines in sources you might not follow.

The “What? So What?” column helps you immediately understand not only what happened, but often, who was behind it, how they operated, and what to watch for.

Example 2: Industry cyberattacks

If threat actors are targeting your competitors, they are likely to target you next. Why? Many industries use similar software, processes, and defensive postures. If a threat actor finds success targeting one company in the industry, they are likely to pivot to the next. This view narrows cyberattacks to those affecting companies in a specific industry, such as finance.

For any listed attack, you can explore the Cyberattack Insights card for additional details, including the timeline, threat actors, malware, and more. You can also read source articles at the bottom of the cards to see the original context.

Example 3: Supply chain attacks

When a vendor, supplier, or service provider is compromised, attackers can use that entry point to pivot into your environment through legitimate access credentials, compromised software updates, or shared data.

Within Feedly, you can create a Custom List of your critical vendors, suppliers, and service providers. This Custom List functions as an AI Model in the Cyberattack Intel Agent, allowing you to filter for attacks specifically targeting companies in your supply chain, ensuring you stay informed about threats that could affect your organization's extended attack surface.

Example 4: Ransomware

Ransomware remains one of the most disruptive threats facing security teams, with new variants and groups emerging regularly. Tracking emerging ransomware helps you identify which groups are actively targeting your industry, understand their evolving tactics, and spot attack patterns before they impact your organization.

The Cyberattack Intel Agent allows you to filter specifically for ransomware attacks, providing a focused view of recent incidents with full context, including ransomware families, targeted industries, threat actors, TTPs, and IoCs. This visibility enables you to update detection rules, prioritize patching efforts, focus your threat hunting, and brief stakeholders on emerging risks before you respond to an active incident.

Note: The "Ransomware attacks" and "Ransomware" AI Model are distinct filters that behave slightly differently. Selecting "Ransomware attack" surfaces incidents where ransomware was the cause, even if the specific ransomware is not attributed. The “Ransomware” AI Model would only include attacks where a Ransomware program was named in the attack.

Example 5: Attack types

Different attack types require different defensive strategies, and understanding which threats are actively targeting organizations like yours helps you prioritize security controls effectively. The Cyberattack Intel Agent enables you to filter by specific attack types or track multiple simultaneously, giving you a focused view of what matters most to your environment.

Example 6: Geographic Threat Monitoring

Cyberattacks rarely happen in isolation. When threat actors successfully compromise organizations in your region, they often reuse those same TTPs against similar targets. Early awareness enables proactive defense.

This filter enables security teams to determine if their peers, suppliers, or partners within their geographic region are experiencing attacks. Adding filters, such as industry or product, to your tech stack can further refine the attacks to only those relevant to you, so you can prioritize threats and implement appropriate monitoring or mitigation controls.

Summary

The Cyberattack Intel Agent delivers precision filtering based on your intel needs, so you can focus your time and energy on relevant attacks. We provided some simple yet powerful examples of how you can use filtering to achieve different objectives. Ideally, it also inspired you to think of how you could combine these filters for even more precision.