An AI analyst that investigates an Indicator of Compromise (IOC) — an IP, domain, hash, or URL — by querying 9 real threat intelligence feeds and reasoning about what it finds.
Built on mcp-threatintel. Sources: AbuseIPDB,
GreyNoise, AlienVault OTX, URLhaus, MalwareBazaar, ThreatFox,
Feodo Tracker, Spamhaus DROP, plus DNS.
Most automated triage tools give you a verdict with no explanation. That's fine until a SOC analyst has to defend a block decision.
ThreatLens streams the agent's reasoning as it happens. You see which source it picks, why it picks it, and how each finding updates its assessment. Every claim in the final report is backed by an actual API call.
LOW 0–3 MED 4–6 HIGH 7–8 CRIT 9–10
Paste the raw email (use "Show Original" in Gmail or "View Source" in Outlook). ThreatLens extracts every IP, domain, URL, and sender identity, then runs the full agent investigation on each.
Starting…
Enter an IOC to begin. The agent's reasoning will appear here in real time.
Once the agent finishes, the structured report appears here.