What's in the Feed Right Now
Every number below is pulled live from our production MISP cluster. This is not a marketing estimate — it is the current state of the active IOC database, refreshed every 10 minutes.
Fetching live counts…
Threat Intelligence Services
End-to-end TI capabilities — from raw IOC ingestion to boardroom-ready strategic reports.
IOC Feed Management
Curated feeds of malware hashes, C2 domains, phishing URLs and IP blocklists. STIX 2.1 formatted, delivered via TAXII 2.1 for automated ingestion into your SIEM and EDR.
Dark Web Monitoring
Continuous monitoring of dark-web forums, paste sites and Telegram channels for leaked credentials, data exposure, brand mentions and planned attacks against your organisation.
Adversary Profiling
MITRE ATT&CK-mapped profiles of threat actors targeting your sector. Understand their TTPs, tooling, infrastructure and historical campaigns to anticipate their next move.
Threat Hunting
Hypothesis-driven hunts using IOCs and behavioural indicators to find adversaries already inside your network. We search what automated tools miss — living-off-the-land, lateral movement and dormant implants.
MISP Platform Management
We deploy, configure and manage your MISP instance — feed curation, event correlation, sharing groups, taxonomies and integration with your existing security stack.
Strategic Intelligence Reports
Monthly and quarterly reports for CISOs and boards covering threat-landscape shifts, sector-specific risks, geopolitical cyber trends affecting India, and recommended defensive actions.
Drop-In Integration with Your Stack
Four ways to consume the Ogma TI feed. All require only a bearer token you generate in the customer portal. No cron jobs, no manual imports.
Fortinet FortiGate — External Block List (EBL)
FortiGate pulls the feed automatically every 60 minutes. Use the connector as a source address in any firewall policy.
FortiGate UI → Security Fabric → External Connectors → New → IP Address Threat Feed (or Domain Threat Feed).
Palo Alto Networks — External Dynamic List (EDL)
PAN-OS fetches the list on the interval you configure. Reference it directly in any security policy.
PAN-OS → Objects → External Dynamic Lists → Add → IP List / Domain List.
SIEM Integration
Native connectors for every major SIEM. IOCs enrich alerts automatically — no custom parsing, no stale lookup tables.
- Splunk — TA add-on (TAXII 2.1 collector)
- Elastic / OpenSearch — ingest pipeline JSON
- FortiSIEM — native STIX collector
- Microsoft Sentinel — Threat Intelligence Platform connector
SOAR & REST API
Token-authenticated JSON endpoints for SOAR playbooks (FortiSOAR, Splunk SOAR, XSOAR) and custom automation.
Bearer auth. Rate-limited per token. Dev docs in-portal.
How Our TI Platform Works
Threat intelligence is only useful when it reaches your defences in real time.
1. Collect & Curate
MISP aggregates IOCs from 40+ sources — OpenPhish, CISA KEV, Emerging Threats, Spamhaus DROP/EDROP, SANS DShield, Abuse.ch, Tor exit nodes, commercial feeds, dark-web monitoring and Ogma in-house research. Analysts deduplicate, enrich and score every indicator.
2. Distribute via TAXII 2.1 / Feed URLs
STIX 2.1 objects publish to TAXII endpoints; plain-text feeds serve FortiGate EBL and Palo Alto EDL. Your SIEM (Splunk, Elastic, FortiSIEM, Sentinel), SOAR and EDR (CrowdStrike, FortiEDR) auto-pull feeds.
3. Detect & Block
IOCs become detection rules and blocklists across your stack. Known-bad IPs hit firewall deny lists. Malware hashes trigger EDR alerts. Phishing domains are blocked at the DNS layer. CVEs under active exploitation move up your patch queue.
Why Ogma for Threat Intelligence
We don't just sell feeds. We operate the platform, curate the intelligence and integrate it into your defences.
MISP Expertise
Production MISP deployments with feed curation, galaxy clusters, warninglists and automated correlation engines.
1.4M+ Live IOC Library
Continuously enriched indicator database covering malware, C2, phishing, active CVEs and India-specific threat infrastructure.
STIX / TAXII Native
All intelligence published in STIX 2.1 with TAXII 2.1 endpoints. Standards-based, vendor-agnostic, automation-ready.
India-Focused Landscape
Threat actors targeting BFSI, government, healthcare and critical infrastructure in India. Regional context your global vendor can't provide.
SOC Integration
TI feeds plug directly into your SOC workflow — enriching alerts, automating triage and reducing analyst investigation time.
Compliance Reporting
TI reports mapped to CERT-In, RBI, SEBI CSCRF and ISO 27001:2022 requirements. Evidence packages for audits and regulatory submissions.
Frequently Asked Questions
Turn Threat Data into Defensive Action
Talk to Ogma's threat intelligence team. We'll assess your current TI maturity and build a program that fits your stack, sector and budget.