DATASHEET

BrightCloud® Threat Intelligence Services Overview
Empowering defenders with comprehensive, real-time threat intelligence
Challenge
The ever-increasing volume, speed, and sophisticationof cyberattacks requires a response beyond traditional
security. Cybercriminals are continuously launching
dynamic, stealthy threats designed to infiltrate network
defenses through multiple attack vectors. Companies needsolutions that are as dynamic as the attacks they defend
against, to stay ahead in the ever-evolving threat landscape.
Security solution vendors depend on comprehensive,
reliable, real-time, actionable cyber threat intelligence torealize the full potential of their products and services indetecting and mitigating threats.
BrightCloud® Threat Intelligence Services provide
unmatched visibility and insights into threats across URLs,
IP addresses, file hashes, cloud applications and more.
Our platform leverages sixth-generation machine learningmodels to deliver up-to-date, actionable intelligence.
It offers the breadth and depth of data our technology
partners need to keep customers and their assets safe. Ourservices are trusted by global network and security industry
leaders and innovators, who use BrightCloud’s predictive
intelligence to keep their solutions and customers ahead ofthe ever-evolving modern threats.

Comprehensive, powerful, 			predictive, and proven
BrightCloud Threat Intelligence provides operational threat
intelligence that is comprehensive, powerful, predictive, andproven. It features:• Threat intelligence services covering multiple criticalthreat vectors• A network of more than 95 million connected sensors• A cloud-based platform that collects, analyzes, correlates,and disseminates threat data with remarkable accuracy
and speed• Predictive risk scores generated by analyzing andcorrelating multiple forms of threat data with sixthgeneration machine learning models

BrightCloud Threat Intelligence features a
cloud-based platform that collects, analyzes,
correlates, and disseminates multiple types of
threat data with remarkable accuracy and speed
and generates predictive risk scores using sixthgeneration machine learning models.

BrightCloud® Threat Intelligence Services provide technology
vendors with comprehensive operational threat intelligencethat is always up-to-date, highly accurate, contextualized,
and actionable. BrightCloud does this through robust security
offerings that cover web, file, and IP-based threats. Theseservices are all powered by the BrightCloud Platform.
Web Classification and Web Reputation Services
BrightCloud’s Web Classification Service and Web Reputation
Service keep end users from visiting unwanted and unsafe
sites by providing content classification and independent
reputation scores for more than one billion domains andover 43 billion URLs. With 86 website categories, theWeb Classification service enables partners to accurately
identify websites that propagate malware, spam, spyware,
adware, and phishing attacks, as well as websites with illegal
or sensitive content, such as adult materials, drugs, andgambling. The Web Reputation Service delivers valuable
contextual and behavioral information about websites,
including the threat history of each domain, site popularity
metrics, geo-locations, and networks associated with thewebsites. It also features a Web Reputation Index (WRI) withreputation scores that organizations can use to fine tune
security settings. Using BrightCloud’s categories, contextual
information, and reputation scores, organizations can maketheir networks more secure, adhere to HR and compliancepolicies, and enforce effective web policies that protect
users against web threats and prohibited content.

• Integration with the world’s leading technology andsecurity providers
1

IP Reputation Service

Streaming Malware Detection

The IP Reputation Service offers intelligence on more thanfour billion IPv4 and IPv6 addresses. It uncovers morethan 600,000 new malicious IP addresses daily, as well as
providing metadata and insights on each IP address thatcan be used to improve incident response and security
analytics. The IP service is updated continuously, to thwart
threat actors who rapidly cycle through new addresses.
The service enables security solutions vendors and theircustomers to quickly detect web-based attacks, block
traffic from malicious internet hosts, identify botnets andthreat actor command and control systems, whilst finetuning security settings based on risk tolerance.

BrightCloud’s Streaming Malware Detection technology
detects malicious files containing both recognized andpolymorphic malware. Thousands of files a minute canbe parsed as they pass through a gateway, often without
requiring complete files to be downloaded, avoiding unduenetwork latency. Files can be blocked, allowed, or routed
for additional investigation based on partner requirements.
Streaming Malware Detection helps to prevent cyberattacks
that involve malware, and it can also improve theperformance of other security solutions by pre-filtering
malicious files.
File Reputation Service

Real-Time Anti-Phishing Service
The Real-Time Anti-Phishing Service determines whether
a website is being used for phishing at the precise momenta user encounters it. This provides live protection againstzero hour phishing attacks, including those utilizing
disguised redirection and recently hijacked websites. The
service evaluates URLs and page content using hundredsof site attributes and contextual information, including thereputation of embedded links, the history of threats from thedomain, and the length of time the site has existed. Advanced
machine learning models ensure that results are useful
and accurate with low false positive rates. The Real-Time
Anti-Phishing Service allows organizations to improve theeffectiveness of web, email, and network security solutions
and defend against ransomware campaigns, spear phishingattacks, and fraud from newly observed phishing links.

The File Reputation Service checks executable files against
a cloud-hosted database of billions of known good andbad file behavior records so that integration partners canefficiently block or allow files or flag them for analysis.
Files are collected from millions of real-world sensors andevaluated continuously using advanced machine learningtechniques. Files are identified through a unique fingerprint,
including those that are encrypted or password protected.
The service also provides contextual information about files
such as the date when they were first detected, how manytimes they have been detected by BrightCloud sensors,
and the type of malware they contain. The File Reputation
Service not only helps security solution vendors and theircustomers block malicious executables, it also helps cloud
applications and service providers ensure that files alreadystored are free of malware.

INFRASTRUCTURE

AWS, Cloudera, Hadoop, Cassandra, New Relic & others

DATA

Operational and environmental data

95M+ CONNECTED SENSORSPROCESSING

Behavioral analysis and actionable data

5 MINS

269M+ Partner End Users
17M+ Consumer & Business Endpoints

FROM DISCOVERY TOUNIVERSAL PROTECTION

PRODUCT SERVICES

Products, Support, Telemetry, Intelligence

Partners & Integrations

The BrightCloud Platform

2

Cloud Service Intelligence

Trusted and proven Intelligence

Cloud Service Intelligence enables security solution vendors
and their customers to identify and manage interactions
with both authorized and “shadow IT” cloud services andapplications. As users interact with cloud resources, theservice identifies and classifies services and applications,allows identification of unsanctioned “shadow IT” services,
allowing partner solutions to track and control theseinteractions based on policies, while assessing the riskof the applications based on governance, compliance,and security metrics. Cloud Service Intelligence helps
organizations enforce web access policies, control shadow
IT, flag abnormal interactions, and reduce the risk of attacks
through unknown and insecure web service providers.

Security solution vendors want threat intelligence thatis current, actionable, and accurate. They want broad
coverage of the threat landscape and context that explains
why objects and behaviors are security or compliancerisks. That’s exactly what BrightCloud® Threat Intelligence
Services provide, which is why they are trusted by theworld’s leading technology and security providers.

A cloud-based platform designed 			for volume, accuracy, and speed
Threat actors are everywhere and move fast. Defenders
need comprehensive intelligence and visibility so they
can move faster. The BrightCloud cloud-based threat
intelligence platform features limitless scale, lightning-fastdata processing, and globally distributed service delivery
for high performance and resilience. This infrastructure
enables the platform to absorb data from more than
95 million global sensors and real-world endpoints
while analyzing, correlating, and disseminating criticalintelligence in real time.
Data correlation for contextual, 				predictive threat intelligence

Partner benefits with 			BrightCloud® Threat Intelligence Services• Effective cybersecurity
BrightCloud® Threat Intelligence Services enable ourpartners to provide proactive, automated cybersecurity
solutions to their customers, solutions that deliver
unobtrusive and effective security and policy enforcement
to meet today’s most pervasive threats.
• Deep knowledge for superior protection
BrightCloud® Threat Intelligence Services leveragecontextual intelligence and behavior analysis to overcome
the accelerating pace of threat innovation. They power
the mitigation of threats the moment they appear on any
network or device connected to the BrightCloud Platform.
• Flexible integration options
BrightCloud® Threat Intelligence Services integratewith existing security solutions through the BrightCloudsoftware development kit (SDK) and an easy-to-use
REST API. Depending on the service, it may be integrated
in any of three modes (hosted, local database, orhybrid), allowing partners to select the integration anddeployment type best suited to their needs. Additional
integration option information is available on eachservice’s datasheet.

BrightCloud® Threat Intelligence Services use a powerfulcontextual analysis engine and advanced artificial
intelligence to map the relationships between billions ofinterconnected internet objects and services. Uncovering
associations between an object and other URLs, IPs, files,
cloud services and applications, and mobile apps allows theBrightCloud platform to accurately predict how likely it isthat the object is malicious.

Learn More

For example, an IP address that other services classify
as safe might be tied to URLs and files with histories ofdangerous behavior. BrightCloud’s advanced analysis would
provide a predictive reputation score in the “Suspicious”
or “High Risk” range for this IP address, enabling security
teams to examine or block communication with it and defend
their organization against attacks from that source.

Power your security solutions with the speed andaccuracy required to protect your customers from newwaves of sophisticated online threats. With BrightCloud®
Threat Intelligence Services, you can overcome the next
generation of internet-borne threats, protect your customers
from malicious actors in real time, and stay at the forefrontof cybersecurity technology.
Visit www.brightcloud.com to learn more.
Phone: +1 800 870 8102

OpenText Cybersecurity provides comprehensive security solutions for companies and partners of all sizes. From prevention, detection and response to recovery, investigation and compliance,
our unified end-to-end platform helps customers build cyber resilience via a holistic security portfolio. Powered by actionable insights from our real-time and contextual threat intelligence,
OpenText Cybersecurity customers benefit from high efficacy products, a compliant experience and simplified security to help manage business risk. DS_011924
Copyright © 2024 Open Text Corporation. All rights reserved.

3