Threat intelligence & detection
Where the feeds come from, what behavioral detection looks for, and how to read an incident without guessing.
Two different mechanisms sit behind the Threats and Detections tabs, and they fail in opposite ways. Threat intelligence is a lookup: is this address on a list of known-bad ones? Detection is behavioral: does what this program is doing look wrong, regardless of where it's going? Lists miss anything new. Behavior flags things that turn out to be fine.
Threat intelligence
NetSecWall mirrors public and commercial reputation feeds — malware command-and-control, phishing, abuse-reported hosts — and checks every destination against them as connections appear. A hit shows on the connection itself, so you see which program reached it.
- Lists refresh on a schedule; a machine that has been offline is checking against whatever it last downloaded.
- We host and deduplicate the feeds, so it's one fast download rather than a dozen third-party fetches.
- Newly registered domains are flagged separately. Being new is not evidence of anything. Still, a brand-new domain that a program contacts once and never again is a pattern worth knowing about.
Behavioral detection
This watches shape rather than destination. The signals that matter most in practice:
| Signal | What it means | Innocent explanation |
|---|---|---|
| Beaconing | Connections on a regular timer — the signature of malware checking in | Update checkers, telemetry, and push clients all beacon too |
| Unusual volume | Far more data than this program normally moves | A backup, a game update, a big upload you started |
| First-seen process | An executable reaching the internet for the first time | Anything you installed recently |
| Suspicious location | Running from a temp or download directory | Installers legitimately do this |
NetSecWall maps findings onto the MITRE ATT&CK matrix, a shared vocabulary for attacker techniques. That's useful for grouping related findings into one story rather than reading 10 separate alerts.
Reading an incident
Work through it in this order — it's the fastest route to a decision:
- Which program? Recognize it? Did you install it? Where does it run from?
- Where to? Does the destination make sense for that program? A text editor talking to a CDN is normal; a text editor beaconing to a residential IP is not.
- Since when? First seen today, or has it been doing this for months?
- How much? A few bytes on a timer reads very differently from a sustained upload.
If it still looks wrong, block it. Blocking is reversible and costs you nothing but that program's network access — see Blocking.
Still stuck? Open a support ticket — we reply within one business day.