Key Takeaways
-
Threatconnect is a mature threat intelligence platform (TIP) and security orchestration, automation, and response (SOAR) hybrid that aggregates, normalizes, and enriches threat data while offering automation playbooks and cyber risk quantification.
-
Dataminr acquired Threatconnect in late 2025, and former Threatconnect leadership now operates inside Dataminr’s executive team and roadmap.
-
Threatconnect 8.0 added agentic artificial intelligence (AI) agents with a natural-language interface for plain-language queries and automated threat model generation.
-
The platform supports intelligence lifecycle management and investigation workflows but requires separate processes and tools for threat takedown.
-
Cyble provides an AI-native alternative with managed takedown and more than 70 enterprise integrations for organizations that want early warning and removal from a single vendor.
Threatconnect’s Acquisition And Roadmap Under Dataminr
Dataminr announced its intent to acquire Threatconnect in October 2025, and by November 2025 Dataminr’s customer-facing materials described Threatconnect as “now a part of Dataminr.”
The acquisition positions the combined offering around real-time event intelligence fused with intelligence-management capabilities. Dataminr states that the acquisition supports a unified cyber defense strategy that combines its AI-powered external intelligence with Threatconnect’s intelligence-management features, enabling client-tailored intelligence and autonomous threat and exposure management.
Standalone TIP customers now face a clear consideration. Threatconnect increasingly functions as part of Dataminr’s event intelligence stack rather than as an entirely neutral TIP. Dataminr’s “Dataminr for Cyber Defense” product reflects this direction by fusing external foresight with internal telemetry.
The leadership transition reinforces this integration path. Balaji Yelamanchili, former chief executive officer (CEO) of Threatconnect, now serves as President and Chief Operating Officer at Dataminr, and Chris Lehman, former President of Global Field Operations at Threatconnect, now serves as Chief Revenue Officer at Dataminr. These roles show that Threatconnect’s senior leaders now operate inside Dataminr’s structure rather than running a separate business unit.
Buyers evaluating Threatconnect as a standalone TIP should factor in this ownership trajectory. Dataminr’s broader strategy now shapes the roadmap, with a focus on agentic AI, real-time physical and cyber event intelligence, and enterprise-scale distribution.
How Security Teams Use Threatconnect In A SOC
Threatconnect targets mid-market and large enterprises with dedicated analysts and mature security stacks.
Within a security operations center (SOC), the platform supports four primary workflows:
-
Threat investigation and incident response: Analysts use case management, indicator enrichment, and graph visualization to pivot across related infrastructure and actor profiles during investigations.
-
Vulnerability management prioritization: The cyber risk quantification (CRQ) module translates technical exposure into financial and operational impact so teams can prioritize remediation by business risk instead of severity scores alone.
-
Cross-team coordination: Security leadership, SOC teams, threat intelligence analysts, governance, risk and compliance (GRC) teams, fraud teams, and brand protection leads work from a shared intelligence layer.
-
Intelligence lifecycle management: The platform manages collection, normalization, enrichment, dissemination, and feedback in one environment.
Threat Intelligence Platform: Core Objects And Enrichment
The TIP module aggregates, normalizes, and enriches data from hundreds of open-source and premium feeds into a central hub.
Threatconnect organizes intelligence around four core object types: Cases, Indicators, Groups, and Tags. These objects define how the platform structures and relates data.
-
Indicators are atomic data points such as IP addresses, file hashes, domains, and URLs. They carry limited analytical value on their own.
-
Groups add context that turns indicators into intelligence. Group subtypes include reports, campaigns, incidents, vulnerabilities, actor profiles, and MITRE ATT&CK techniques.
-
Tags are metadata labels that apply to indicators, groups, or cases for fast filtering and automation triggers.
-
Cases support workflow-based case management that combines manual and automated steps for cyber threat intelligence (CTI), SOC, and incident response (IR) processes.
The platform scopes intelligence sources through an Owners field. Analysts can filter search results by owner to isolate findings by intelligence source, which helps manage multi-feed environments with varying reliability.
Decryption Digest’s May 2026 buyer’s guide notes that Threatconnect ingests Structured Threat Information Expression (STIX)/Trusted Automated Exchange of Intelligence Information (TAXII), CSV, JSON, and vendor-specific formats, supporting aggregation from third-party and internal sources. STIX 2.1 now serves as the standard intelligence format for major government agencies and most commercial TIPs.
SOAR Playbooks: Turning Intelligence Into Action
The SOAR module streamlines workflows and runs customizable or no-code automation playbooks so teams can mitigate risks faster.
Threatconnect offers automation that ranges from no-code to custom-code Playbooks, which supports both simple and complex tasks. Security teams without engineering resources can build basic enrichment and notification workflows, while technical teams can write custom integrations.
Native SOAR integration within the TIP creates a structural advantage. Decryption Digest’s May 2026 TIP and SOAR integration guide highlights Threatconnect as distinctive for combining a TIP with built-in case management and workflow orchestration, which positions it as a hybrid TIP and SOAR option for organizations that do not operate a separate SOAR platform.
Organizations that already run a SOAR platform can use Threatconnect as a TIP data source, with connectors for major SOAR tools. In a SOC workflow, Playbooks form the execution layer that turns intelligence into action by automating enrichment lookups, notifications, and response steps.
CRQ And Risk Quantifier: Connecting Risk To Business Impact
The CRQ module, which includes Risk Quantifier, measures and manages the financial and operational impact of potential cyber threats.
Risk Quantifier provides an exposure scoring model that converts technical risk into financial terms. Security leaders use this model to prioritize remediation by business impact, and executives and board members use it to connect cyber risk to budget and strategy decisions.
Heights Consulting Group’s 2026 review notes that Risk Quantifier supports measurable cyber risk assessment as a core module. In a SOC workflow, the CRQ module acts as the prioritization layer that informs resource allocation and board reporting.
CAL Intelligence And Investigation Support
Collective Analytics Layer (CAL) intelligence uses machine learning (ML) and AI insights to enrich indicators and support investigation workflows.
Threatconnect’s CAL global intelligence applies AI and ML-powered insights to what the company describes as the industry’s largest ground-truth threat telemetry from its global user community.
CAL data appears in the platform as queryable metadata. The 8.1 release notes describe a calLastChecked indicator field that records when the TIP last contacted CAL for an indicator’s CAL Global Threat Score and CAL status. This design makes enrichment freshness an auditable property within the data model.
The CAL Automated Threat Library (ATL) addresses a common analyst workload. The ATL distills more than 60 popular unstructured open-source intelligence (OSINT) sources, such as blogs, into a structured, ready-to-use threat intelligence feed, which reduces manual reading and extraction work.
The Explore in Graph feature visualizes relationships between groups, indicators, and aliases in an interactive interface. In a SOC context, CAL functions as an investigation accelerator that helps analysts connect indicators to associated actors, campaigns, and infrastructure.
Platform Mechanics: TQL, STIX/TAXII, API/SDK, And Agentic AI
TQL (Threatconnect Query Language)
TQL is the platform’s structured query layer for filtering and retrieving intelligence across the data model. Threatconnect 8.0 introduced new TQL operators such as sameNameAs for indicator lookups and nested query parameters like hasCommonVulnerability() for filtering group types.
Threatconnect documents TQL usage in the Recalculate ThreatAssess feature to find indicators with missing or stale CAL-derived data, including queries such as calLastChecked is NULL or date comparisons against calLastChecked. TQL therefore supports both investigations and enrichment maintenance.
Account settings include a configurable TQL timeout, which matters for organizations that run complex queries against large indicator sets.
STIX/TAXII
STIX defines structured threat intelligence objects such as indicators, threat actors, campaigns, and their relationships. TAXII is the transport protocol that moves STIX bundles between systems. According to iTechGuides’ September 2026 review, Threatconnect supports STIX/TAXII 2.1 exchange and a threat intelligence REST API. This support positions the platform for integration with government sharing communities and sector information sharing and analysis centers (ISACs).
API/SDK And The MCP Server
Threatconnect’s Agentic TIP Model Context Protocol (MCP) Server exposes the v3 REST API as MCP tools over a hosted endpoint, so any MCP-compatible client can access threat intelligence and case management data.
The core MCP toolset covers the full resource lifecycle:
-
tc_listretrieves filtered, paginated results using TQL and supports nested field expansions such as tags, security labels, attributes, and associated groups. -
tc_getretrieves a single resource by ID. -
tc_create,tc_update, andtc_deletecreate, replace, and delete resources. -
tc_describereturns field names and TQL syntax for a resource type.
Authentication requires an API token prefixed with “APIV2,” which only Organization Administrator users can retrieve. Dynamic tools are generated per active MCP-triggered playbook and remain scoped to the organization, so a token from one organization cannot access another organization’s playbook tools.
8.0 Agentic AI Release
Threatconnect 8.0 introduced the Agentic Threat Intelligence Platform, which includes four purpose-built AI agents accessible through the Ask AI interface. These agents are designed to:
-
Answer questions about platform data in plain language
-
Generate threat models from a single prompt
-
Draft intelligence reports quickly
-
Build Intelligence Requirements (IRs) through guided conversation
The architecture combines a large language model (LLM) reasoning layer with direct access to Threatconnect intelligence and workflow data, built on the existing playbook framework. Users can interact with data without building playbooks, writing TQL queries, or relying on technical resources for every automation.
See Cyble’s AI-native approach
Honest Limitations Of The Threatconnect Platform
A neutral evaluation of Threatconnect highlights three structural limitation categories: deployment complexity, analyst time requirements, and scope boundaries around takedown.
Deployment Complexity
Heights Consulting Group’s 2026 review notes that Threatconnect’s feature depth requires training to use advanced modules effectively and avoid misconfiguration. Integration with existing security infrastructure adds implementation overhead that organizations must plan for during deployment.
A Dataminr case study describes a deployment model that relies on deployment engineers and a dedicated customer success engineer for rollout and initial setup. The same case study notes that training covered the full security team, including members outside the core intelligence function, with a goal of self-sufficiency after go-live.
Analyst Time Required
viaSocket’s May 2026 review observes that organizations with lower operational maturity may underuse parts of the platform at first, while teams with established processes can operationalize it quickly.
“Value is highest when your team is ready to operationalize workflows fully.”
A full TIP requires sustained analyst investment to remain effective. Feed curation, indicator lifecycle management, playbook maintenance, and enrichment quality all depend on ongoing attention. Organizations should assess whether current analyst capacity can absorb this operational overhead alongside existing workloads.
Scope Boundaries: Intelligence Without Takedown
Threatconnect surfaces and organizes intelligence but does not execute takedown. When the platform detects a phishing site, a lookalike domain, or leaked data, removal requires a separate process that may involve internal legal teams, a registrar’s abuse team, or a dedicated takedown provider. That gap between detection and removal represents a structural limit rather than a configuration choice, and it matters most for organizations that treat detection-to-removal speed as a core requirement.
AI-Native Alternatives: Where Cyble Differs
Cyble Vision operates at the collection layer instead of the report layer. Entity resolution, relevance scoring, and enrichment occur before an analyst opens a case, so analysts start with structured intelligence rather than a raw data dump. The table below compares the two platforms across attributes that buyers commonly weigh.
|
Attribute |
Threatconnect Platform |
Cyble Vision |
|---|---|---|
|
Primary architecture |
TIP-SOAR hybrid with CRQ module |
AI-native at collection layer |
|
Ownership |
Part of Dataminr (acquired 2025) |
Independent |
|
Takedown capability |
Separate provider required |
Native managed takedown with service level agreements (SLAs) |
|
Integration approach |
API/SDK with STIX/TAXII 2.1 support |
More than 70 enterprise integrations including REST APIs and TAXII |
Cyble Vision covers CTI, attack surface management (ASM), and digital risk protection (DRP) on a single platform. Cyble reports a 98% takedown success rate and a 95% signal-to-noise ratio, with visibility into more than 15,000 darknet marketplaces and enriched alerts delivered in minutes rather than hours. Results depend on each customer’s environment, asset scope, and configuration, and capabilities, coverage, and service levels vary by subscription tier and region.
Cyble’s API and TAXII support allow intelligence to flow into and out of the platform through standard protocols. More than 70 enterprise integrations, including Splunk, Microsoft Sentinel, IBM QRadar, Cortex XSOAR, and ServiceNow, help findings reach the tools analysts already use instead of forcing work into a separate console.
Native managed takedown forms the key structural differentiator. Detection and removal come from one vendor under SLAs, so the gap between “we found it” and “it is gone” closes inside a single platform workflow.
For a direct comparison of how Cyble positions against other platforms in the threat intelligence market, see the Cyble comparison hub.
Frequently Asked Questions
What is the Threatconnect platform?
Threatconnect is a threat intelligence platform that aggregates, normalizes, and enriches threat data from open-source and premium feeds, orchestrates security response through SOAR playbooks, and quantifies cyber risk through its CRQ module. The 8.0 release added agentic AI agents accessible through a natural-language interface. Dataminr has owned the platform since its 2025 acquisition.
Who bought Threatconnect?
Dataminr announced its intent to acquire Threatconnect in October 2025. By November 2025, Dataminr’s customer-facing materials described Threatconnect as part of Dataminr. Former Threatconnect executives, including the former CEO, now hold senior leadership roles at Dataminr, and the combined offering is marketed under the Dataminr for Cyber Defense brand.
How is the Threatconnect platform deployed?
The platform is available as software as a service (SaaS) through Threatconnect Cloud or as an on-premises deployment. Access is available through a web interface, API, and self-hosted options. Vendor-led enablement is typical for enterprise deployments, with deployment engineers and customer success engineers guiding setup and training.
What integrations does the Threatconnect platform support?
Threatconnect integrates with major security tools, including endpoint detection and response (EDR) tools, security information and event management (SIEM) and analytics platforms, and ticketing and information technology service management (ITSM) systems such as Archer. The platform offers a v3 REST API, along with Python, Java, and JavaScript software development kits (SDKs). The TC Exchange Catalog provides pre-built integrations searchable by tool name. SOAR connector support covers major platforms for organizations that operate a separate SOAR alongside the TIP.
What data sources does the Threatconnect platform use?
Threatconnect ingests STIX 2.1 threat intelligence objects from TAXII feeds via its TAXII Ingest App, extracts indicators from structured CSV files, ingests enriched feed data as JSON via Feed API Service Apps, and includes OSINT and CAL feeds as well as vendor-specific integrations such as Intel 471. The CAL Automated Threat Library distills more than 60 unstructured OSINT sources, such as security blogs, into structured, ready-to-use intelligence. Organizations can also configure their own feed sources scoped by the Owners field.
How long does Threatconnect platform implementation take?
Implementation timelines vary by environment complexity, integration requirements, and the number of modules deployed. Vendor-led enablement is the standard model. Case studies indicate that the first two months typically focus on deployment, training, and establishing operational workflows, with expansion to additional use cases, such as incident response, in later phases.
What are common limitations of the Threatconnect platform?
Independent reviews frequently cite three limitations. Deployment complexity requires training to use advanced modules effectively and avoid misconfiguration. The platform demands sustained analyst time to remain useful, with value highest when teams are ready to operationalize workflows fully. The platform surfaces intelligence but does not execute takedown, so detection and removal of phishing sites, lookalike domains, or leaked data require separate processes.
Is the Threatconnect platform scalable?
The platform offers a customizable and scalable architecture that targets mid-market and large enterprises. SaaS and on-premises deployment options support different operating models. Enterprise contracts are sized to organizational requirements, and the playbook automation layer can expand as operational maturity grows. Organizations with lower operational maturity may initially underuse some capabilities.
Conclusion: How To Weigh Threatconnect Against AI-Native Options
Threatconnect is a mature TIP-SOAR hybrid with a clear capability set across four functional areas: TIP aggregation and enrichment, SOAR playbook automation, CRQ through Risk Quantifier, and CAL-supported investigations. Its platform mechanics give technically literate buyers a concrete view of how it works. These mechanics include TQL for structured querying, STIX/TAXII 2.1 for intelligence exchange, a v3 REST API with MCP server support, and the 8.0 agentic AI release.
Dataminr’s ownership now shapes the roadmap, with a focus on fusing external event intelligence with internal telemetry under the Dataminr for Cyber Defense brand. Each organization needs to decide whether this direction aligns with its preference for a neutral TIP or a tightly integrated event intelligence stack.
Takedown sits outside Threatconnect’s scope. The platform detects and organizes intelligence, while removal requires separate processes and providers. For teams that treat detection-to-removal speed as a primary outcome, that structural gap carries significant weight during evaluation.
Cyble Vision addresses this gap with an AI-native architecture at the collection layer and native managed takedown. It combines the API and TAXII support described earlier with the broader integration ecosystem and managed removal services that many organizations now expect from a single vendor. To see how Cyble compares across the threat intelligence market, visit the Cyble comparison hub.
Talk to Cyble about closing your detection-to-removal gap