Skip to main content
The Intel lookup page is something you go to. Platform-aware detections come to you: with Flarehawk Intel enabled, your own detection pipeline consults platform-wide intelligence in real time, so an attacker who is already corroborated as malicious elsewhere is treated more seriously the first time they hit you.

​
How it works

When Flarehawk generates an alert tied to a source IP or ASN, it checks that entity against the platform’s high-signal intelligence:
  • If the entity is a strong, corroborated bad actor, the alert’s severity is promoted by one level (for example, medium → high).
  • Either way, the alert is annotated with the platform signal so your analysts can see the cross-customer context behind the escalation.
This means a brand-new attacker to your environment can still arrive pre-scored, using the collective experience of every other customer.
Severity promotion is gated to organizations with the Flarehawk Intel add-on and is applied conservatively — only when the cross-platform signal is strong. The underlying platform context is attached to the alert regardless, so you always see why an escalation happened.

​
What counts as a strong signal

Flarehawk promotes severity only when the offending entity clears a high bar: a high Flarehawk Intel Score. The score is a composite that already incorporates cross-org prevalence, enforcement rate, and risk — so a source that’s strongly corroborated as malicious across many organizations scores high and triggers promotion, while an entity with thin or mixed signal does not. The richer detail behind a verdict — the cross-customer campaigns an entity belongs to and its JA3/JA4 fingerprints — is available for investigation on the Intel lookup page. Campaign- and fingerprint-specific escalation on the detection hot path is on the roadmap; today, that intelligence is surfaced for analyst investigation and folded into the composite score.

​
Where you see it

Escalations and platform context appear in the Incidents view:
  • The alert carries its promoted severity, so it sorts higher in your triage queue.
  • The alert detail includes a platform signals annotation describing the cross-customer corroboration — the score, how many organizations are involved, the attack categories, and any associated campaign.
  • When several customers are caught in the same campaign, the incident’s correlation naturally reflects that shared activity.

​
How it relates to the rest of detection

Platform-aware detection is an enrichment layer on top of your existing detection, not a replacement:
  • Your statistical baselines, ML models, and rules still decide whether something is an alert.
  • The Flarehawk Risk Score (FRS) still contributes its per-request maliciousness signal.
  • Flarehawk Intel adds one more, cross-customer perspective — and only ever raises confidence, never suppresses your own detections.
Because the platform-signals annotation is always present (even without the score promotion), it’s a useful triage aid on its own: when two otherwise-similar alerts land in your queue, the one corroborated across the platform usually deserves your attention first.

​
Privacy

The platform signals attached to your alerts are anonymized aggregates — they tell you that an entity is corroborated across organizations and how it behaves, never which organizations saw it. See Privacy & anonymization for the full guarantees.