What is a threat intelligence platform?

A threat intelligence platform (TIP) is software that holds indicators, attaches context, and lets humans and machines query them. It is not an EDR (it does not sit on laptops). It is not a SIEM (it does not replace log search). It is the CTI layer those tools should consume.

Gartner-style TIPs (Anomali, ThreatConnect, Recorded Future) sell closed collections, scoring, and SOAR connectors. Makondoo is a thinner, honest stack:

Store — Threatr on a private origin, only reachable with a Cloudflare Access service token.
Ingest — a Cloudflare Worker cron/queue pulls public feeds every 12 hours.
Expose — a public adapter at api.threat-intel.makondoo.org for the SPA and for your scripts.
Investigate — one-observable lookup, cached vendor data, free OSINT overlays.
Assets — BOM from crt.sh plus optional CycloneDX/SPDX → OSV.

What this TIP will not pretend to be

We do not sell “AI that predicts APT attribution.” We do not run Have I Been Pwned email search (that API is paid). We do not have a free Cisco Talos or Umbrella Investigate feed. Paid vendor keys, if Kondoo holds them, stay on Threatr and are never burned with force=true from the public UI.

If you need a commercial TIP with analyst shift coverage, talk to the usual vendors. If you need a live open-source CTI console you can actually click, use Makondoo threat intelligence.

What does threat intel do?

Threat intelligence turns raw signals — malicious IPs, phishing URLs, malware hashes, attacker infrastructure — into something a defender can act on. On Makondoo, that means a live IOC dashboard from Threatr, an investigate panel for a single observable, and an attack-surface BOM built from certificate-transparency logs.

What is threat intelligence in simple terms?

It is evidence about who is attacking, how they attack, and which indicators to block. Data without context is a blocklist. Intelligence is that data plus source, timing, and how it relates to your assets.

What are the five stages of the threat intelligence lifecycle?

Direction (what you need to know), collection (feeds and lookups), processing (normalize and dedupe), analysis (what it means for you), and dissemination (dashboard, API, BOM). Makondoo covers collection through dissemination for public CTI; direction stays with your security team.

What is a threat intel platform?

A threat intelligence platform (TIP) stores indicators, enriches them, and exposes them to analysts and tools. Makondoo is a Threatr-backed TIP: ingested open feeds, cached vendor enrichment, a public adapter API, and BOM/SBOM matching — not a SIEM and not an EDR.

What is Threat Intelligence?

Cyber threat intelligence (CTI) is analyzed information about adversaries and their infrastructure. Strategic CTI is for leaders. Operational CTI is about campaigns. Technical CTI is IOCs you can put in a firewall. This site publishes technical CTI from public feeds and Threatr.

Is Makondoo threat intelligence free?

The public dashboard, investigate lookups (without forcing vendor refresh), BOM scans, and adapter API are free to use, rate-limited at 100 requests per hour per IP. Team and Enterprise are contact-sales for private ingest and hosted Threatr.