Threat Intelligence &malware analysis
Cyber threat intelligence (CTI) is knowledge about attackers and their tools. One platform checks suspicious files, shares warning signs (IoCs) and collects threat data. Each step feeds the next.
What you get
- Detection rules
- Capability analysis & virus scanner
- Malware archive
- Automated analysis pipeline
- Threat intelligence databases
- CTI knowledge graph
Features at a glance
Proven open-source tools for threat data and malware analysis. All set up to work as one.
Detection rules
Scan and sort files with rules, from the community or your own. Rules have versions, and you can test them first.
Capability analysis
Find out what a program can do. It may reach the network, stay on the machine or hide from analysis. The report shows you.
Virus scanning
Classic virus scans with signatures that stay up to date. This is your base layer of detection.
Malware archive
A safe store for malware samples. It keeps metadata, fingerprints (hashes) and links between samples. Tags control who sees what.
Automated pipeline
A file analysis pipeline that grows with your load. It runs every check in turn and sorts the results for you.
Threat database & knowledge graph
Share warning signs with partners, both ways. Keep your threat data in good order in the knowledge graph.
Your benefits
Threat data only helps when it is linked up. The platform joins tools that used to work alone. You detect, analyze and share in one loop. That makes your security team stronger.
- One place for all malware analysis
- Warning signs shared with partners on their own
- A well-kept CTI knowledge graph
- Faster triage for your security team, since the pipelines come ready to use
- Self-hosted, so no sample leaks to third parties
Use cases
Incident response
Analyze the files you find during an incident. Get warning signs you can act on within minutes.
Proactive hunting
Scan endpoints with detection rules built from the latest threat reports.
ISAC / community sharing
Swap warning signs with peers and trusted industry groups (ISACs). Shared labels keep the data in one form.
Threat reporting
Build threat reports for the board. They draw on knowledge graph data and map to MITRE ATT&CK.
How Threat Intelligence works in practice
The analysis tools run in a separate package called SecTepe.Core.CTI. It is a set of small services in containers. SecTepe.Core talks to them through an API. You see the results inside the platform.
From sample to indicators
A central controller accepts each file. It passes the file to the detection rules, the capability analysis, the virus scanner, a file type check and a config extractor. Packed files go to an unpacker. The controller then checks the unpacked content again. Jobs run in the background, and you can follow them live.
- The capability analysis shows what a program can do. It maps this to MITRE ATT&CK, a public catalog of attack methods.
- The controller collects and merges the warning signs of each job. It can also draft a detection rule from a job.
- Reports come out as PDF or JSON.
- The optional SecTepe Malware Sandbox runs samples in Windows and Linux guests and archives its detections.
Watching what belongs to you
SecTepe.Core also uses threat data to watch your own footprint.
- Domains and public IPs: Core checks your external assets against the knowledge graph and the threat database. New critical or high alerts send an email to your tenant admins.
- Suppliers: Core searches the knowledge graph for each supplier. It checks the supplier's website and contact emails in the threat database. Each sweep records which sources answered. So "nothing found" is never mixed up with "nobody could look".
- Ransomware leak sites: Core matches public victim lists against your domains and company name. Hits go to your data protection officer as candidates. Nothing is downloaded at this step.
- Employee self-service: Staff can check whether their own work email shows up in known leaks.
Operation and data sovereignty
You run the CTI package yourself. It runs in containers or on Kubernetes. You switch on extra services through profiles. An air-gap profile keeps the malware lab offline by default. Sending data to the threat database and the knowledge graph is off. Samples never go to public online virus scanners. Roles can keep jobs apart per tenant.
Common questions
Which threat feeds come with it? The threat database ships with 73 preset feeds, for example from abuse.ch, CIRCL and Botvrij. Importers also pull CERT advisories into it.
Does it work with my SIEM? Yes. A connector sends CEF to ArcSight, LEEF to QRadar and UDM to Google Chronicle.
Ready to link up your threat intelligence?
Book a personal demo. See how SecTepe.Core links malware analysis, IoCs and CTI in one closed loop.
How we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.
Common questions
We hear these questions most often in a first call. For anything else, write to hello@sectepe.de or give us a call.
- How do we start working with SecTepe?
- Every project starts with a free first call. Then you get an offer with scope, timeline and result. If you like, we start small with a pilot. That way you get to know us before the real work starts.
- What company sizes and sectors do you support?
- We work for small and mid-sized firms, for parts of large groups and for operators of critical infrastructure (KRITIS). Often that means industry, trades, health, banks, energy and public bodies. Our focus is mid-sized firms in Germany, Austria and Switzerland.
- Do you work on site, remotely or hybrid?
- Both. Reviews, advice and most services run remotely from German data centers. For workshops, training and emergencies we come to you, mainly in North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
- Which standards and regulations do you cover?
- We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
- How do you protect the confidentiality of my data?
- By contract and by technology. Before every project, both sides sign a non-disclosure agreement. Your data stays in German data centers. Every access needs a second login factor and is checked one by one. Our whole team is bound to secrecy by contract and under the GDPR.