Site search

Search results

Search solutions, research, integrations and community tools.

All results

Scout Enterprise

Scout Enterprise. END USER LICENSE AGREEMENT. THIS IS A LICENSE AGREEMENT (“. TERMS. ” OR THE “. AGREEMENT. ”) BETWEEN PURE SIGNAL RECON AND/OR PURE SIGNAL SCOUT (“. LICENSED PRODUCT(S). ”) CUSTOMER (“. CLIENT. ”) AND TEAM CYMRU INC. (“. TEAM CYMRU. ”).…

Scout Terms

The terms of use that apply to Team Cymru Scout trial services, including acceptance of terms, permitted use and how Team Cymru may update them.

Pure Signal Scout Trial Agreement Terms of Use. 1. Acceptance of Terms: Pure Signal Scout (herein referred to as “Scout”) trial services that Team Cymru provides to You (CLIENT) are subject to the following Terms of Use ("TOU").…

Scout Researcher

Scout Researcher. END USER LICENSE AGREEMENT. THIS IS A LICENSE AGREEMENT (“. TERMS. ” OR THE “. AGREEMENT. ”) BETWEEN PURE SIGNAL RECON AND/OR PURE SIGNAL SCOUT (“. LICENSED PRODUCT(S). ”) CUSTOMER (“. CLIENT. ”) AND TEAM CYMRU INC. (“. TEAM CYMRU. ”).…

Pure Signal Scout Now Integrated with Google SecOps

Team Cymru's Pure Signal Scout now integrates with Google SecOps, adding internet-scale NetFlow context to investigations, threat hunting, and response.

Supercharge Threat Hunting: Team Cymru Pure Signal™ Scout Now Integrated with Google SecOps. For Security Teams: Network Intelligence Meets Cloud-Scale Analytics.…

Special Episode: Now Introducing Pure Signal Scout with Team Cymru's Josh Picolet and Wassim Tawbi

Josh Picolet, Director of S2 Threat Analysis Unit, and Wassim Tawbi, Head of Product Management, about their new product, Pure Signal Scout

Wassim Tawbi. , Head of Product Management, about their new product, Pure Signal Scout.…

Filigran OpenCTI + Team Cymru | Pure Signal™ Scout Integration

Turn Team Cymru Pure Signal™ Scout into a live indicator source in OpenCTI. Enrich IPs with ASN history, ports, and certificates and automate hunts.

By integrating Team Cymru's Scout capabilities, OpenCTI users can now access the world's largest ocean of external threat telemetry directly within their TIP.…

Team Cymru Unveils Pure Signal Scout: The Fastest Tool on the Market for Global Threat Infrastructure Analysis

Team Cymru, a global leader in external threat intelligence and digital risk management solutions, today announced the launch of Pure Signal™ Scout, the world's fastest tool for external threat hunting and malicious infrastructure analysis.

Team Cymru Unveils Pure Signal Scout: The Fastest Tool on the Market for Global Threat Infrastructure Analysis. Lake Mary, Florida. June 15, 2023.…

Palo Alto Cortex XSOAR + Team Cymru | Scout Integration

Enrich Cortex XSOAR with IP and domain intel from NetFlow, WHOIS, passive DNS, and X.509. Get Team Cymru's no-cost Scout pack on Cortex Marketplace.

Team Cymru’s Pure Signal Scout immediately enriches XSOAR with comprehensive IP address and domain insight to: Enable SOC, Threat Intel, Vulnerability and GRC teams to handle larger volumes of work and do more with fewer resources.…

2024 Year in Review: Features and Improvements in Pure Signal™ Scout

Team Cymru is excited to share our accomplishments in delivering new features and improvements in Pure Signal™ Scout.

Firstly, thank you to our Scout user base for the many contributions and feedback throughout the year to refine Scout into the product you love using everyday.…

Pure Signal™ Scout Insight Pricing | Plans and Packages

Compare Pure Signal™ Scout Insight plans. Choose 3-user or unlimited access with API queries, tagged results and 30 days of searchable data.

Unlock the power of Scout Insight's advanced capabilities with our flexible plans to meet your needs.Whether you're a small team or a large enterprise, we have a plan for you. Information. Scout Insight 3 User. Scout Insight Unlimited. Licensed Users. 3.…

Vertex Synapse + Team Cymru | Pure Signal™ Scout Integration

Pivot faster in Vertex Synapse. Team Cymru Pure Signal™ Scout enriches alerts with NetFlow, passive DNS, and certificate data in one place.

Scout + Synapse. Team Cymru's Pure Signal™ Data Ocean Enables Vertex Synapse Teams To Accelerate Threat Response. Request a Demo. Partner Portal. Partner Program. Resellers, MSPs. &. SIs. Technology Partner. Become a Partner.…

Microsoft Copilot + Team Cymru | Scout Plugin for Threat Hunting

Ask Microsoft Copilot for Security about any IP or domain in plain language. Team Cymru's Scout plugin turns Pure Signal™ data into key insights.

Pure Signal Scout Plugin for Microsoft Copilot. Discover how Pure Signal Scout empowers SOC teams with real-time, scalable threat intelligence. Watch 1-Minute Demo. Partner Portal. Partner Program. Resellers, MSPs. &. SIs. Technology Partner.…

Eating Your Own Dog Food: Pure Signal Use Cases | Team Cymru

Explore how Team Cymru's SecOps team uses its own threat intel tools—Scout, Recon, and more—for faster investigations, proactive hunting, and automation.

As an amuse bouche, our Scout threat hunting tool is a great place for us to begin. Investigating an alert from your SIEM? Just enter a URL or public IP into the Scout search bar to get started. Here we have some useful information at a glance.…

Google SecOps + Team Cymru | Scout Enrichment for SIEM and SOAR

Auto-enrich every IP on ingestion with Team Cymru Scout in Google SecOps. Playbooks to block IPs and open tickets are included at no extra cost.

Google SecOps, the leading SIEM and SOAR platform is now integrated with Team Cymru’s Scout as a Google-certified App.…

Scout API for IP and Domain Intelligence | Red Dragon Program

Build your own self-service integration. Red Dragon Technology Alliance members use Team Cymru's Scout API to enrich IPs and domains in their own tools.

The Team Cymru Scout API is now available through our Red Dragon Technology Alliance Program. This enables you to easily create your own “self-service” integration. Access Scout API. Partner Portal. Partner Program. Resellers, MSPs. &. SIs.…

Splunk + Team Cymru | Scout App for IP and Threat Intelligence

Enrich Splunk dashboards with real-time IP intelligence from Team Cymru Scout. Query up to 10 IPs at once and send detections to email, Slack, or SOAR.

Scout App for Splunk. Enrich Splunk, accelerate IR and enhance investigations with Real-time IP Intelligence. Try it Free. Listen to Podcast. Partner Program. Resellers, MSPs. &. SIs. Technology Partner. Become a Partner. Team Cymru + Splunk.…

Team Cymru Scout Integration with Palo Alto Cortex XSOAR | Team Cymru

Enhance threat response with Team Cymru Scout’s IP and domain intelligence, now integrated into Palo Alto Cortex XSOAR for automation and real-time insights.

What is Team Cymru‚Äôs Scout? Team Cymru‚Äôs Scout is a powerful, web & API-based. threat intelligence. and investigation tool designed for security analysts of varying experience levels.…

Scott Fisher

Pure Signal™ Scout. Pure Signal™ Radar. MCP Server. Total Insights Feed. Global Defender Exchange. Bogon Networks. DDOS Mitigation UTRS. Nimbus Threat Monitor. MHR - API. CSIRT Assistance Program. IP-to-ASN Mapping. Support. 0900-1700 ET. 1400-2200 UTC.…

Faster IOC Threat Hunting in One Query | Pure Signal™ Scout

Stop tab-hopping between lookups. Team Cymru's Scout fuses NetFlow, passive DNS, x509, and WHOIS into IOC threat intelligence you can act on in one query.

PURE SIGNAL™ SCOUT // REAL-TIME THREAT INTELLIGENCE. Real-time threat. intelligence on any IOC. IOC threat hunting where infrastructure context arrives attached, before an analyst has to go looking for it.…

Threat Intelligence Integrations for SIEM, SOAR & AI | Team Cymru

Bring Team Cymru threat intelligence into Splunk, Google SecOps, Sentinel, XSOAR, and your AI copilots. Enrich alerts in place without switching consoles.

Splunk · Scout. Scout App for Splunk. Splunk app with custom search commands that enrich events, dashboards, and saved searches with Scout IP intelligence. Python. TC Docs. Splunkbase. Splunk · Feeds. Feed App for Splunk.…

Accelerate Your Investigation with New Splunk Integration | Team Cymru

Add real-time threat data to Splunk with the Team Cymru Scout App and simplify investigations using enriched dashboards and IP/domain insights. Read more.

Last year, we launched Pure Signal Scout, a web-based threat-hunting and intelligence tool for security analysts of all experience levels.…

Team Cymru Launches Pure Signal™ Scout Insight for Enhanced Proactive Security with Advanced External Threat Intelligence

Team Cymru announces the launch of its latest innovation, Pure Signal™ Scout Insight

Team Cymru Launches Pure Signal™ Scout Insight for Enhanced Proactive Security with Advanced External Threat Intelligence. Lake Mary, FL. May 6, 2024. LAKE MARY, FL. –.…

Fingerprinting Malware C2s with Tags | Team Cymru

This blog is written for threat analysts, defenders, and CTI teams who use our Scout platform—but even if you’re not a user today, it offers practical insight into how advanced research teams fingerprint C2 infrastructure, and how you might apply similar methods using your tools.

These Tags will then appear in the NetFlow records and are searchable within our Pure Signal products, including Scout and Recon. They can be used to filter out or inspect certain network traffic.…

Operationalize Pure Signal™: Team Cymru Integration for OpenCTI

Enhance your threat hunting in OpenCTI with Team Cymru’s Pure Signal™ data. Learn how to use dedicated Scout connectors for deep enrichment, infrastructure mapping, and automated STIX relationship graphing.

By triggering the Scout Enrichment Connector on a single IP address, analysts can discover a deep, multi-faceted threat profile, turning a simple observable into a rich source of context.…

Query Pure Signal Data: Team Cymru Power-Up for Synapse Enterprise

Instantly run Team Cymru Scout queries on the Pure Signal™ data ocean directly within Synapse Enterprise. See how to hunt for phishing infrastructure, analyze communication patterns, and unpack malicious IPs for frictionless, confident analysis.

The following examples are representative of ways analysts can run Scout queries within the new Synapse Power-Up for Team Cymru. Search by Communications Patterns.…

RADAR: Seamless Threat Hunting from Discovery to Attribution

Learn how RADAR’s pivot feature automatically generates queries in Scout, allowing analysts to move from infrastructure discovery to threat attribution seamlessly.

With a click of a button, analysts can automatically generate prebuilt queries in Scout or Recon based on selected IPs or CIDR ranges in RADAR for deeper investigations. Using RADAR for Threat Hunting and Attribution.…

C2 Infrastructure Recon: Pivoting on GRIMBOLT With X509 Certificates

Explore how to Map GRIMBOLT C2 infrastructure linked to UNC6201 by pivoting from one IP using WHOIS, PDNS, ports, and X509 certificate fingerprints.

Building an IP Profile in Scout. (WHOIS, PDNS, Ports, X509). Using a Scout summary, we can view the current attributes about the IP address.…

Radar

Map the internet-facing assets tied to any domain without scanning. Team Cymru Radar returns enriched IPs, domains, CVEs and KEVs in a live map.

Discover unknown or third-party infrastructureSee exposure instantly, without scanningPivot into Scout or Recon to take action. Who benefits. SOC & CTI analysts. Risk & compliance teams. Anyone needing visibility beyond the firewall.…

Industrial Cybersecurity | Analysis of Exposed ICS and OT Devices

Industrial cybersecurity analysis of exposed ICS and OT devices. Discover how attackers target critical infrastructure and how defenders can detect exposed systems.

Identifying Exposed Units with Scout. To visualize the current exposure of these devices, we can utilize the following Scout query: tag = "hitachi".…

Team Cymru Tags Explained: Powering Faster, Smarter Threat Intelligence | Team Cymru

Discover how Team Cymru Tags deliver real-time context to analysts, enabling faster triage, better threat detection, and automation-ready intelligence. Learn more.

With Tags visible in Scout or Recon, analysts can pivot quickly. For example, a controller tag linked to DarkComet tells you this is likely C2 infrastructure for a RAT. Automation-Ready.…

Ransomware Incident Response: Infrastructure Analysis

A year of incident response data reveals how Akira, DragonForce & Clop build ransomware infrastructure — and how defenders can hunt it.

Relevant Scout Queries. Customers with Team Cymru Scout™ can use the following set of queries to identify infrastructure matching the behavior of the ransomware gangs highlighted in this blog.…

Threat Hunting LegionRelay C2 Servers Targeting Ukraine

See how threat hunting in Team Cymru Scout surfaced five previously unreported LegionRelay C2 servers tied to a Russia-aligned campaign targeting Ukraine.

Pivoting in Team Cymru Scout. Rather than treating the published indicators as a static list, we used their shared characteristics as a fingerprint.…

Scattered Spider Attacks | Infrastructure and TTP Analysis

An in-depth analysis of Scattered Spider attacks, detailing the group’s infrastructure usage and TTPs to help defenders detect and disrupt activity earlier.

Using Scout, it is possible to identify these brands of VPN exit nodes. Mullvad, NordVPN, and ExpressVPN are the most regularly observed. Scout Query. tag = "mullvad,nordvpn,expressvpn".…

Team Cymru Announces Integration With Microsoft Security Copilot to Bring Immediate AI-Generated Context to Security Teams

New solution combines 30M daily IP classifications with 2,000+ contextual tags to slash false positives and streamline security operations.

Team Cymru's Pure Signal™ Scout Plugin for Copilot enables customers to gain immediate clarity and respond to threats in real time. March 20, 2025 –.…

APT Attacks in Singapore Telecom: UNC3886 ORB Tracking Explained

APT attacks by UNC3886 target Singapore telecom using ORB networks. Learn practical ORB tracking techniques to uncover hidden infrastructure with Scout.

UNC3886 IOCs shared by Mandiant enriched by Team Cymru Scout. Multiple threat reports on UNC3886 are available via Malpeida. here. ORBs detected by Team Cymru on Singaporean IPs. ORBs in Singapore.…

Postman's Joshua Scott on How Security Protects APIs and Builds Customer Trust

Joshua Scott, Head of Information Security & IT at Postman. They discuss the importance of security as more companies use APIs, and how better security improves reputation and trust with customers.

Postman's Joshua Scott on How Security Protects APIs and Builds Customer Trust. In this week's episode of the Future of Cyber Risk podcast, David speaks to. Joshua Scott. , Head of Information Security & IT at. Postman.…

Activate Pure Signal™ MCP | Team Cymru

Connect your AI agents to the world’s largest threat intelligence data ocean. Activate your Pure Signal™ MCP server access.

What to expect: Active Scout Customers: Request your MCP activation key for immediate integration. Agents start querying real intelligence the same day.…

Find Exposed Assets with Passive Discovery | Pure Signal™ Radar

Zero packets sent. Team Cymru's Radar is a passive asset discovery tool that finds your shadow IT and exposed services from traffic already observed.

One-click pivots into Scout and Recon. Full API access for workflow automation. By the Numbers. 0. PACKETS SENT TO YOUR ASSETS. 400. B+. DAILY CONNECTIONS OBSERVED. 60. +. DATA TYPES FUSED. 2,300. +. BEHAVIORAL TAGS. // THE VISIBILITY GAP.…

Building Effective Threat Hunts: Insights from Splunk | Team Cymru

Splunk’s David Bianco shares threat hunting tips, team-building strategies, and how to use red teaming to improve detection capabilities and security operations.

Team Cymru Scout App for Splunk. , the ability to enrich threat data and automate detection is becoming increasingly vital.…

Team Cymru & OpenCTI Integration: Better Threat Intelligence

Accelerate triage and automate threat hunting with the Team Cymru and OpenCTI integration. Combine global visibility with open-source orchestration for faster defense.

By fusing Team Cymru‚Äôs Pure Signal Scout Connector with OpenCTI, we‚Äôve created a unified platform environment where every alert, every search, and every investigation is amplified. Here‚Äôs how: 1. Accelerate Triage & Response.…

Protecting Critical National Infrastructure: ORB Networks & OT Visibility

Adversaries are pre-positioning for destructive attacks on CNI. Learn how to track nation-state threat actors and ORB networks to harden the OT boundary "left of boom."

Using Team Cymru Scout to query netflow communications, we can search for all BlueVPS and Hostinger IPs that have been communicating with Fortigate systems in Poland, using a search such as tag = "fortigate" cc = "PL" comms.asn = "62005,47583".…

Validating ShinyHunters & Cyber Threat Actor Infrastructure

Use network telemetry to validate cyber threat actors' phishing infrastructure. Track ShinyHunters clusters and defend against SaaS data exfiltration.

Starting from the hosting provider and domain naming criteria, a single Scout query returned three results: asn="201814" pdns.domain="*internal.com,*sso.com". Scout query result for Mevspace AS201814 with the Cluster A domain pattern.…

DTCC’s Scott Scher on Why CTI Teams Forecast Instead of Predict

Learn how to build a cyber threat intelligence framework that drives decisions. Scott Scher discusses CTI metrics, AI, and strategic threat intelligence.

DTCC’s Scott Scher on Why CTI Teams Forecast Instead of Predict. Show notes: Scott Scher. , Cyber Threat Intelligence Lead, makes a distinction that reframes how intel teams should think about their own value: they are forecasters, not predictors.…

Team Cymru and OpenCTI Partner to Supercharge Threat Intelligence With Global Visibility

Team Cymru integrates Pure Signal intelligence into OpenCTI to provide global visibility, automated threat hunting, and instant enrichment for security teams.

The collaboration brings Team Cymru’s Pure Signal™ intelligence and Scout capabilities directly into OpenCTI, enabling defenders to access global visibility, instant enrichment, and automated threat-hunting workflows without ever leaving the platform.…

Team Cymru is Redefining Simplicity and Visibility in Cyber Threat Intelligence with Launch of Pure Signal Scout

…

NetFlow Data That Reveals Threats Beyond Your Perimeter

See malicious infrastructure and attacker movement before damage is done. Team Cymru turns raw NetFlow data into decision-grade threat intelligence.

Scout. An accessible entry point for teams leveraging external telemetry. Streamlined intelligence platform for rapid threat assessment and investigation. Accessible interface. Rapid threat assessment. External telemetry integration. Explore Scout.…

Pure Signal Scout May Finally be the Tool to Help Threat Hunters Move from Reactive to Proactive

…

Dragon News Bytes | Cybersecurity Newsletter and Threat Updates

Get curated cyber threat news, research, and incidents in a daily digest. Dragon News Bytes from Team Cymru keeps vetted defenders current, at no cost.

Continuous Threat Exposure Management (CTEM) Explained

What continuous threat exposure management is, how Gartner's five-stage CTEM program works, and how external visibility strengthens each stage.

tcblogposts

Will Thomas

Tarek Sendi

Josh Picolet

David Monnier

Brian Eckman

James Shank

Abigail Lorion

Rob Thomas

IX Signup

Sign up for IX Protect to access your network data enriched with threat intelligence. Provide your details and ASN to get started. Learn more about our services.

Team Cymru Cybersecurity Blog | Threat Research and Intelligence

Named threat actors, mapped C2 infrastructure, and ransomware teardowns from the Team Cymru intelligence team. New research every week, no registration.

We could not find a page that matches your search. Try one of these starting points, or search for a product, tool or topic.

Start here

Solutions

Threat Intelligence Solutions

Built on observed traffic, not scraped data, so your team can stop attackers before they act.

Explore the solutions →

Integrations

Bring Team Cymru threat intelligence into Splunk, Google SecOps, Sentinel, XSOAR and your AI copilots.

See the integrations →

Resources

Resource Library

CISO guides, case studies, eBooks and product briefs from Team Cymru.

Browse the library →

Customers

Customer Stories

How banks, network operators and global enterprises use Team Cymru threat intelligence.

Read the stories →

From the Resource Library

Reports and guides on this topic

Browse the Resource Library →

eBook

Executive Strategy, Risk & ROI

The CISO's Ultimate Guide to Threat Reconnaissance ROI

How organizations reached a 488% ROI with proactive threat reconnaissance. A CISO guide backed by Forrester research.

Get the guide →