Threat intelligence

What it is and why use it

Vex Raptor combines Threat Feed and Cross-Intelligence (Enterprise) to surface relevant CVEs, intel feeds, and correlations across your scan history.

Before you start

• Threat Feed: Enterprise plan.
• Cross-Intelligence: Enterprise plan.
• Optional API keys for enrichment (NVD, OTX, etc.) configured by your operator — features degrade gracefully when keys are absent.

Step by step

Threat Feed

1. Open Threat Feed (/threat-feed).

1. Filter by vendor, product, or severity.

2. Pivot from an item to related assets or scans when links are shown.

Cross-Intelligence

1. Open Cross-Intelligence (/intelligence).

1. Run or review cross scans that compare findings across targets.

1. Open the compliance posture API/view when exposed in UI (GET /api/v1/intelligence/compliance).

What you will see

Intel cards, CVE references, and aggregated metrics scoped to your organization.

Common problems

• Empty feed — enrichment keys not configured on the instance.
• 403 — Enterprise plan required.

Next steps

• Attack surface monitoring
• API overview