Where Does the Threat Data Come From?
Public and government feeds, matched against your own events, with a review workflow that stops a match being either ignored or over-read. Named sources, no mystery “proprietary intelligence”.
In short
- Seven named sources, including the US government's catalogue of vulnerabilities known to be actively exploited.
- Matching happens on your appliance. Your events are not sent anywhere to be checked.
- Every match gets a disposition — confirmed, false positive, blocked, monitoring — recorded with who decided and why.
- Bulk review is deliberately awkward. Marking a hundred matches read in one click is how a queue gets cleared without being reviewed.
- Matching never blocks ingest. Under load it drops its own work rather than slowing collection.
Named sources, not “proprietary intelligence”
A vendor that will not name its sources is asking you to buy a claim you cannot check. Chronolith consumes public and government feeds and says which.
| Source | What it provides |
|---|---|
| CISA Known Exploited Vulnerabilities | Vulnerabilities the US government has confirmed are being exploited in the wild |
| MITRE ATT&CK | The adversary technique framework detections are mapped against |
| AlienVault OTX | Community-contributed indicators |
| URLhaus | URLs distributing malware |
| MalwareBazaar | Malware sample hashes |
| Spamhaus | Addresses associated with abuse |
| Feodo Tracker | Command-and-control infrastructure |
These are the feeds where the signal-to-cost ratio is defensible for a firm of six to sixty people. The CISA catalogue in particular is the highest-value list in security for a small firm: it is not “this could be exploited”, it is “this is being exploited right now”, published by a government agency, free, and short enough to act on.
Your events never leave the building to be checked
The usual model for threat intelligence is a lookup service: your product sends an address, a hash or a domain to the vendor and gets an answer back. That means a stream of your internal activity leaving your network, to a third party, continuously.
The indicators come in and matching happens locally against your own event store. Nothing about your estate is transmitted to check it. The only outbound traffic is fetching public lists that anyone can download.
For a customer base with a strong preference for keeping everything on premises, that distinction is usually the deciding one — and it means the capability still works on a network with no internet access at all, using whatever indicators were last loaded.
A match is a question, not a verdict
An indicator match means something in your estate touched something on a list. That is worth looking at. It is not, on its own, a compromise — and treating it as one produces exactly the alert fatigue that makes the next real match invisible.
Every match therefore carries a disposition, recorded with who set it and why:
- Pending — nobody has looked yet.
- Confirmed threat — reviewed and real.
- False positive — reviewed and not.
- Blocked — action was taken.
- Monitoring — not resolved, deliberately being watched.
Applying one disposition to many matches is genuinely useful when a scanner or a known service generates hundreds of identical hits. It is also the fastest way to clear a queue nobody reviewed, which is the opposite of what a disposition is for.
So bulk actions are scoped, recorded against the person who applied them, and require the set to be selected rather than offering a one-click “mark all read”.
Matching never slows collection
Indicator matching sits alongside the ingest path, not inside it. Matches accumulate in a bounded buffer and are written out in batches.
Under extreme load the buffer discards its oldest entries rather than blocking ingest. Losing some indicator matches is strictly better than slowing or stopping the collection of the events themselves — the events remain in the store and can be re-examined, whereas an event never collected is gone.
Common questions
Is threat intelligence an extra subscription?
No. These are public and government feeds, included in the product with no separate licence. If you already subscribe to a commercial feed, that is a different conversation — we are not claiming parity with paid intelligence, and we would rather say so than imply it.
What if we have no internet access?
Matching continues against whatever indicators were last loaded, and the age of that data is visible rather than assumed current. Feeds are the one part of the product that genuinely benefits from outbound access; everything else works without it.
How current are the indicators?
Each feed syncs on its own schedule, typically daily, and the product records when each last succeeded. A feed that stopped updating is visible as a stale source rather than quietly serving old data as though it were current.
Will this catch a targeted attack?
Probably not, and no honest vendor will tell you otherwise. Public indicator feeds catch commodity attacks — the malware, the botnets, the known-bad infrastructure that makes up the overwhelming majority of what actually reaches a small firm. A genuinely targeted attacker will not appear on a public list. That is what the behavioural detections are for.
Can we add our own indicators?
Yes — indicators from an incident, a peer firm, or a sector body can be added and are matched alongside the feeds, with the same disposition workflow.