--- title: Threat Flow slug: threat-flow docTags: createdAt: 2024-02-15T22:11:06.374Z --- Threat Flow is an AI-assisted reporting engine that generates structured threat intelligence reports scoped to your organization's context, focused on the cybercriminal activity most relevant to you. Reports are sourced from Flare's Data Collection, external entity library, and open web research, cross-checked for consistency. The output is formatted for both technical analysts and executive stakeholders. Drawing on data such as breaches, combo lists, threat actor conversations, and dark web monitoring, Threat Flow helps you effectively detect, analyze, and respond to emerging threats. ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/bqQkrQhsrDuyiHyWE9br7_image.png) *** ## Key features - **Context-scoped reporting: **You define what the report should cover. It can be a specific threat actor, a campaign, a question about your industry's threat landscape, or a combination. The report is scoped to match your requirements, not a generic brief pulled from a template. - **Risk-scored findings with recommendations: **Every report organizes findings by severity. Each finding includes specific recommendations for remediation, detection, or further investigation. The reader knows what matters most and what to do next with no additional interpretation required. - **Cross-checked against open web sources: **In addition to Flare and external intelligence, Threat Flow cross-checks findings against open web sources. This reduces single-source claims and produces more complete, defensible reporting. - **Extracted IOCs and MITRE ATT\&CK mapping: **Reports automatically extract IOCs and map observed TTPs to MITRE ATT\&CK. Your team can move directly from reading to blocking without a separate research step. - **Executive-ready format: **Reports use consistent structure and stakeholder-friendly language. A completed report can be forwarded to a CISO, security leadership, or board without reformatting or additional editing. *** ## Using Threat Flow Click through the following product tour to learn how to use Threat Flow. :::Iframe{iframeHeight="0" code="
Threat Flow provides transparent, technical, and actionable intelligence reports within Flare's Cyber Threat Intelligence module. Configure Flare Intel to receive curated reports managed by the Flare research team based on selected topics of interest and industry context. Custom intel allows generation of on-demand reports by writing a topic description and selecting date ranges and audience parameters. Reports are exported in DOCX and PDF formats and include summaries of relevant IOCs and MITRE ATT&CK techniques. Reports conclude with recommendations and links to third-party sources. Users can pivot to related events in the Flare platform to inspect primary sources of intelligence. Conversation Explorer browses automatically summarized Dark Web conversations. Each conversation contains a summarized Breakdown and a Thread showing individual messages. Search conversations by asking questions and refine results using date range filters. Saved Queries allow users to save specific searches and filter sets for repeat access. Users can select multiple conversations to create Custom Intel by adding them individually through the builder. Custom Intel can be consolidated from conversations found across different searches. Filters enable keyword inclusion or exclusion within conversations. Source filtering is available across over 100 sources monitored by Threat Flow. Multiple filters can be applied simultaneously and cleared as needed. Completed Custom Intel reports are accessible in the Intel section.
"} ::: ::::WorkflowBlock :::WorkflowBlockItem **Define your context** Describe what you want the report to cover. This can be: - A specific actor or campaign you are tracking - A question scoped to your industry or geography (e.g., *"What are the active phishing campaigns targeting financial services organizations in North America?"*) - A follow-up from something surfaced in the Intelligence Browser Be specific. The more precise your context, the more relevant the output. ::: :::WorkflowBlockItem **Review the report** Within minutes, a structured report is generated with an executive summary, risk-scored findings, extracted IOCs, MITRE ATT\&CK-mapped TTPs, and recommended actions. ::: :::WorkflowBlockItem **Research entities** If the report surfaces an actor, malware family, or domain you want to verify before acting on, you can pivot directly to the Intelligence Browser from within the report. **Example:** A report mentions a phishing kit. You can go to the Intelligence Browser, find the malware description, identify the threat actor behind it, open their profile to review behavioral history and Telegram channel activity, and return to the report with confirmed context. All without leaving Flare. ::: :::WorkflowBlockItem **Operationalize extracted IOCs** Once you have verified the findings, the report's extracted IOCs and MITRE ATT\&CK mappings are ready to be pushed into detection and blocking rules via Feeds. No manual copy-paste required. ::: :::: *** ## Threat Flow and the Intelligence Browser These two capabilities are designed to be used together in a bidirectional loop. Threat Flow surfaces what matters, the Intelligence Browser tells you who's behind it. - **Threat Flow → Intelligence Browser:** A report surfaces an entity you want to investigate further. One click takes you to the entity's full profile in the Intelligence Browser. - **Intelligence Browser → Threat Flow:** Research you have conducted in the Intelligence Browser becomes the basis for a Threat Flow report, packaged for stakeholders. Every report can become the starting point for the next research task, and every research session can be packaged into a report. *** ## Features in Threat Flow ::::LinkArray{contentSource="CUSTOM"} :::LinkArrayItem{headerType="IMAGE" headerImage="https://api.archbee.com/api/optimize/c3rdtVdXd3RrWUDgyZZoG-hYpXobkMnQPjB3Zjcym55-20250228-152459.svg"} [Intel](docId\:VX9CxFqQTc833VJ-yhbdp) Create your own custom threat Intelligence using Flare's Data, or view our curated list of Flare Intel. ::: :::LinkArrayItem{headerType="IMAGE" headerImage="https://api.archbee.com/api/optimize/c3rdtVdXd3RrWUDgyZZoG-7XxUz23Pe26XyM_mklRwL-20250228-152451.svg"} [Conversation Explorer](docId\:S1X2khUSs1kYSe0fgK4Nf) Dig into Dark Web Conversations with the Conversation Explorer. ::: :::LinkArrayItem{headerType="IMAGE" headerImage="https://api.archbee.com/api/optimize/c3rdtVdXd3RrWUDgyZZoG-LBwqPEh4yrPp8467kYWHr-20250228-153317.svg"} [Saved Queries](docId:46lWYbaEO5D5QqjpGqb4U) For routine threat monitoring, use Saved Queries to view the latest available information. ::: ::::