New toolset combines threat validation, IOC searches and behavioural analysis to help security teams reduce alert fatigue and improve incident triage.
ESET has expanded its Threat Intelligence portfolio with the launch of ESET Threat Intelligence Investigation Lab, a toolset designed to help security operations centre (SOC) teams validate suspicious indicators, investigate threats and make faster incident-response decisions.
Targeting enterprise SOCs, government organisations, CERTs and managed security service providers (MSSPs), the platform provides a trusted second opinion by combining ESET’s threat telemetry with behavioural analysis. It is designed to complement existing security workflows rather than replace cyber threat intelligence platforms or disrupt established operations.
The solution brings together two capabilities in an API-first workflow: on-demand Indicator of Compromise (IOC) Search and Sample Submission. IOC Search checks IP addresses, URLs, file hashes and domains against ESET’s curated telemetry and threat intelligence databases. Sample Submission uses advanced sandboxing and deeper analysis to provide behavioural evidence about suspicious files.
“Investigation Lab makes ESET telemetry more accessible to clients and enriches it with in-depth behavioural context, helping teams decide faster whether to block, investigate, escalate or close an alert.”
— Roman Kováč, Chief Research Officer, ESET
The integrated approach aims to help analysts distinguish genuine threats from false alarms, reduce alert fatigue and determine whether to block, isolate, escalate or close an incident.
Roman Kováč, Chief Research Officer at ESET, said security teams need fast, reliable and privacy-aware validation of suspicious indicators and files to determine the appropriate response.
Investigation Lab draws on insights from ESET LiveGuard Advanced, the behavioural monitoring module of ESET PROTECT, and the expertise of ESET’s Research, Threat Intelligence and Managed Detection and Response teams.
The service is available separately through the ESET Threat Intelligence portal and via API, enabling organisations to integrate threat validation and investigation into their existing security operations.
