Kaspersky Threat Intelligence Portal is a cloud investigation workspace for security teams working with cyberthreat intelligence. It supports indicator enrichment, malware analysis, threat actor and campaign tracking, and incident response. Threat Lookup connects related threats in Kaspersky's knowledge base, while Threat Analysis examines suspicious files using multiple analysis layers. Users can look up IP addresses, file hashes, domains, and web addresses; registered users can also submit URLs to a sandbox for a report on page activity. AI features summarize threat information for triage, support OSINT search, and trace relationships between searched objects. Actor profiles can link updated tactics, techniques, campaigns, and indicators when related Kaspersky reports are published. Remote MCP connects compatible assistants such as Claude and ChatGPT to portal data. Its REST API supports URL lookups with an API token and file submissions for sandbox analysis, with a documented 256 MB maximum file size. Connectors include Maltego, MISP, Splunk Enterprise Security, IBM QRadar, and Elastic SIEM. Free access is available, but provides limited suspicious-file and URL executions; some report sections may lack data, and full reports require demo access.
Who it is for
The portal is aimed at SOC teams, threat analysts, and threat hunters, including those handling incident response. It may also suit teams that want API or listed SIEM and threat-analysis integrations.
What is good
- Supports IOC enrichment and incident response.
- Threat Lookup connects related threats.
- AI features provide summaries and relationship tracing.
- REST API supports URL lookup and file submissions.
- Lists connectors for Splunk, QRadar, and Elastic SIEM.
What to know first
- Free access limits file and URL executions.
- Some report sections may have no data.
- Full reports require demo access.
- Submitted samples must not be confidential or commercially sensitive.
Verdict
The portal combines threat lookups, file and URL analysis, AI assistance, and integrations for security teams. Free access is limited, and sample submission terms rule out confidential or commercially sensitive material.
Kaspersky Threat Intelligence Portal plans and pricing
All plansCompared on threat intelligence platforms
- Free plan
- Yes
- Indicator enrichment
- Yes
- STIX/TAXII support
- Yes
- Report management
- Yes
- Deployment
- cloud
