ARX Horizon: threat intelligence, a single gateway for all sources
Knowing who is on the other side of a connection changes the way you read an event. ARX Horizon brings threat intelligence sources together in one place and puts them to work for the whole platform.
How it works
A single gateway for all sources, clearly showing where each one is located and what goes outside: internal servers (indicator sharing, vulnerabilities), local copies updated periodically (IP reputation, geolocation, providers) and queries to external services.
In the pipeline every event is enriched with country, provider, threat lists and vulnerability details, and matches end up in a dedicated event family on the SOC pages.
From the portal you can query the sources directly: search for indicators of compromise, list vulnerabilities, check the geolocation and reputation of an address.
Intelligence that stays under control
Each source declares what stays in-house and what goes out: you always know which information leaves the platform and which does not.
ARX Horizon works for all the other modules: ARX Sentry events, ARX Trace investigations and the vulnerabilities in ARX Shield and ARX Expose use the same data.
What it offers: ARX Horizon
- A single gateway for internal and external sources
- Indication of where each source is located and what goes out
- Event enrichment in the pipeline
- Event family for threat intelligence matches
- Direct querying of the sources from the portal
Why choose it
- Readable events: who, from where, with what reputation
- Control over which data goes outside
- One intelligence for all modules
Other modules
Widen your horizon with ARX Horizon
Find out how threat intelligence can make your events clearer.
Contact us