Question 1

What is Shadow Watch?

Accepted Answer

Shadow Watch is a real-time cyber threat intelligence platform. It continuously aggregates indicators of compromise from public threat feeds, tracks threat actors, maps activity to the MITRE ATT&CK framework, and alerts you when your monitored assets appear in threat data or on the dark web.

Question 2

How much does Shadow Watch cost?

Accepted Answer

Shadow Watch is one simple flat monthly subscription that unlocks the entire platform — IOC monitoring, threat-actor intelligence, MITRE ATT&CK coverage, exposure alerting, and detection-rule export, with no tiers or per-seat pricing. You can check your exposure for free first, with no account required.

Question 3

What data sources does Shadow Watch use?

Accepted Answer

Shadow Watch ingests open-source intelligence from sources including CISA Known Exploited Vulnerabilities, ThreatFox, URLhaus, MalwareBazaar, Feodo Tracker, OpenPhish, SSL Blacklist, AlienVault OTX, and major security news feeds.

Question 4

Can I check if my domain, IP, or email is in a threat database?

Accepted Answer

Yes. The free exposure lookup on the home page lets you instantly check whether a domain, IP address, or email appears among active indicators of compromise. Sign in for full context, actor attribution, and remediation guidance.

Question 5

What detection formats can I export?

Accepted Answer

Shadow Watch exports detection content as Sigma rules, YARA rules, STIX 2.1 bundles, and MISP events, so you can push intelligence straight into your SIEM, EDR, or threat-sharing workflows.

Question 6

Who is Shadow Watch for?

Accepted Answer

Shadow Watch is built for SOC teams, threat analysts, incident responders, and security engineers who need continuous, actionable threat intelligence in one place.