Lore exists for one reason: the intelligence you need is already published - it is just scattered. Every week, vendors, CERT teams and government agencies release hundreds of reports, each answering one question about one campaign. No analyst reads all of them, and no single report tells you how a piece of malware, a domain or a technique connects to what another vendor described six months ago under a different name.
Lore collects everything that has been made public into a single library and reads it for you, so a question that used to mean opening forty PDFs becomes one search with an answer you can trace back to its source.
What Lore does with what it finds
- One library, many sources - vendor blogs, CERT and national advisories, government publications, conference and malware write-ups, open-source rule sets and public feeds, collected continuously and analysed the moment they arrive.
- Structured extraction - actors, malware, infrastructure, domains, hashes, URLs, techniques and behaviours are pulled out of free text, so a report becomes data you can filter and compare instead of prose you have to read.
- Cross-reference - the same group is known by many names. Lore resolves them into one identity: Midnight Blizzard is APT29 is Cozy Bear, and the reports, techniques and indicators published under every name are shown together.
- Memory - a new investigation is compared against everything the platform already knows, so you see what was seen before, how often a pattern recurs, and which sources describe the same behaviour.
- Hunting - findings turn into runnable queries in Sigma, KQL and SPL, so analysis ends with something you can deploy rather than a paragraph to file away.
Every answer carries its source
Nothing in Lore is presented without a trail. Each extracted item, each relationship and each AI-assisted finding keeps the document, page and paragraph it came from, together with the exact sentence behind it. AI findings are kept only when their quote is found verbatim in the source. Where the platform infers rather than observes, it says so, and hypotheses stay labelled as hypotheses until evidence supports them. If you cannot verify a claim, you should not have to trust it.
Two kinds of memory
The global library is everything collected from public sources - shared by everyone, because published intelligence is meant to be read together. Your own investigations are private by default: only you see them, and you decide when one becomes public. Company members can work side by side without either side leaking into the other.
Who it is for
Threat-intelligence analysts building a picture of an actor or campaign, SOC and incident-response teams that need to know whether something on a host has been written about before, threat hunters turning public reporting into detections, and anyone learning the field who wants the sources instead of a summary.
What Lore is not
It is not a paid intelligence feed, and not a substitute for one. It works only with what has already been made public, so nothing that was never written down will appear here. It is decision support: extraction and matching are automated and can be wrong or incomplete, so verify before you act. Every report keeps its original author's terms and links back to the source, and if you are a rights holder and want material removed, contact us.