Threat Intelligence: How Global Attack Data Becomes Mitigation Policy

On this page

1. The limits of static IP lists
2. A five-stage pipeline
3. Stage 1: Collect
4. Stage 2: Analyze and curate
5. Stage 3: Verdict and score
6. Stage 4: Distribute
7. Stage 5: Enforce
8. What makes it different

The hard part of defense is not deciding which IP to block. It is knowing what needs to be blocked in the first place. Threat Intelligence analyzes attack data observed around the world in real time, identifies threats early, and turns them into policy you can enforce immediately.

The limits of static IP lists

Many organizations rely on public or purchased IP blocklists. Static lists have structural limits.

• They only contain threats that are already known. New attacks, reassigned IPs and short-lived infrastructure slip through.
• When sources and validation are opaque, the risk of blocking legitimate traffic grows.
• Threats change in real time, while lists always lag behind.

A five-stage pipeline

PacketStream Threat Intelligence turns attack data into real mitigation policy in five stages.

1. 01CollectDeep packet inspection of traffic across our infrastructure
2. 02Analyze and curateMulti-layer behavioral analysis, noise removed by AI
3. 03Verdict and scoreNormalized into Verdict, Score and Category
4. 04DistributeDelivered by REST API, refreshed daily
5. 05EnforceApplied automatically in firewall, CDN and DDoS

Stage 1: Collect

The primary source is not a separate sensor network but deep packet inspection (DPI) of all traffic passing through PacketStream's infrastructure. Under a privacy-first principle, enterprise customers and customers who have not consented can opt out at any time, and that traffic is excluded from inspection.

Third-party threat feeds from partner channels are combined as a secondary source to widen global coverage and cross-validate first-party data.

Traffic inspected per day (approx.)

800TB–1PB

Countries covered with partner channels

195

Stage 2: Analyze and curate

Collected data goes through multi-layer behavioral analysis. AI curation removes noise, and first- and second-party data are cross-validated to keep false positives low.

Stage 3: Verdict and score

Every result is normalized into one schema, so any system that receives it can read it the same way.

-1Unknown

0Benign

1–99Suspicious

100Malicious

A response looks like this. The example IP is from a documentation range.

{
  "ip": "203.0.113.45",
  "verdict": "Malicious",
  "score": 100,
  "category": ["Malware"],
  "summary": "Distributes malware and appears in confirmed attack traffic"
}

Stage 4: Distribute

Verdicts become enforceable policy, such as "block above a score" or "challenge a category". Policy is delivered by REST API: 70M+ threat indicators, refreshed 5–50% daily.

Stage 5: Enforce

Policy is applied automatically in firewalls, CDNs and DDoS mitigation. Integration takes three steps.

1. Issue an API key in the console.
2. Connect automatic blocking to your firewall or CDN rules.
3. See the effect immediately: fewer alerts, less load.

Combined with Always-On inline DDoS mitigation, attacks can be blocked before they ramp up.

What makes it different

• First-party observation. Not a resold, purchased list.
• Accuracy. Cross-validation and AI curation reduce false positives.
• Early detection. Up to 60 days faster than other vendors.
• Reliability. Delivered with a 99.9% SLA.

Large attacks blocked preemptively

95%+

Reduction in security alerts

80%

Exclusive threat data not detected by 92 other vendors

50%+

Security alerts (before = 100)

Before100

After20

A blocklist is just the output. What matters is the process that rebuilds it every day.