What threat intelligence does SuperClue provide?

SuperClue gives you a live feed of new CVEs from the US National Vulnerability Database, 8 OSINT tools that profile suspicious IPs and domains, and correlation that links detections across your hosts. A public live map shows current malicious infrastructure from open threat feeds.

How does the CVE feed work?

New and updated CVEs come from the NVD API 2.0. You can keep a watchlist of the products you run, receive alerts as new entries arrive and see trends over time. For a CVE that affects you, AI-generated fix suggestions explain how to remediate it (4.76 credits per request).

What are the 8 OSINT tools?

  • DNS lookup
  • Reverse DNS
  • Domain WHOIS
  • IP RDAP and ASN lookup
  • IP geolocation
  • Port scan of common ports with banner grabbing
  • Email domain reconnaissance
  • Risk profiler

OSINT also checks free reputation sources: Spamhaus DNS blocklists, the Tor exit node list and Blocklist.de. If you add your own API keys, it also queries AbuseIPDB, Shodan and VirusTotal.

OSINT runs automatically when the SOC agent detects suspicious activity, so the attacking IP is profiled without you starting a search. Manual investigations are limited to platform administrators.

What does correlation do?

  • Links the same activity seen on 2 or more of your machines within an hour into one alert.
  • Matches telemetry against your own indicators: SHA-256 hashes, IP addresses and domains, up to 1,000 of each type.
  • Cross-references findings with NVD CVE data.

What is on the live threat map?

The global threats map plots real public feeds: the SANS Internet Storm Center top attacking IPs, abuse.ch Feodo Tracker botnet command servers and URLhaus malware URLs, located with IP geolocation. The data refreshes every 10 minutes.

Does SuperClue monitor the dark web?

No. SuperClue does not crawl dark web sites. The website scanner includes external exposure checks that look up your domain in the Have I Been Pwned breach catalogue and search certificate transparency logs for certificates issued for your domain. These run as part of a website scan.

See what is active right now.

Open the live threat map