The Maltiverse Threat Observatory is a personalized threat intelligence dashboard that answers one question: who is targeting organizations like yours? By declaring your team's operating countries and industry — your Team Context — the Observatory filters Maltiverse's global dataset down to the threat actors, malware families, detection rules, and Indicators of Compromise (IoCs) that are actively aimed at your region and sector.

The Observatory is powered by the convergence of Lumu's real-time attack detection network and Maltiverse's curated threat intelligence. Attack telemetry contributed by Lumu Defender deployments worldwide enriches Maltiverse IoCs with real-world targeting context — the countries and industries where each indicator has actually been seen attacking. This is the labeling that makes the Observatory's personalization possible.

With the Threat Observatory you can:

• See at a glance how many threat actors, malware families, detection rules, and blockable IoCs are relevant to your region and industry.
• Watch a live cyber threat map and attack feed filtered to your context.
• Drill into full Threat Actor and Malware profiles — MITRE ATT&CK techniques, arsenal, campaigns, vulnerabilities, detection rules, and indicator activity.
• Download YARA rules and pivot Sigma rules into your SIEM.
• Create a custom Threat Intelligence Feed from your context with one click, and consume it from any of your security tools.

Dashboard Overview

The Threat Observatory is available from the left navigation menu of the Maltiverse Portal. Select THREAT OBSERVATORY.

The Observatory also surfaces as a summary card at the top of the Intelligence Panel. The card shows the same context chips and KPIs. Clicking View full threat report takes you to the full dashboard.

The main dashboard is divided into 3 main sections, from summary to detail.

Who is targeting you?

A hero section that displays your team contexts and provides the following key information.

• Team context chips — the configured countries and industry.
• Threat actors — how many threat actor groups are known to target your industry or region.
• Malwares — how many malware families are known to target your industry or region.
• Rules — the total number of YARA and Sigma detection rules available in Maltiverse. Detection rules are not region- or industry-specific, so this figure represents your full deployable arsenal.
• IoCs ready to block — the number of malicious indicators labeled with your countries or your industry. This is exactly the population your custom feed will deliver, and it matches what you get if you run the same query in the Search engine.

If your team has not configured a context yet, this section will display a call to action to configure your team context, check out the dedicated section to learn how to do it. Users without permission to edit the context will see a tooltip indicating that a team leader or researcher must configure it.

Explore the threats

The Explore the threats section provides interactive filters over the same dataset, seeded from your Team Context so the dashboard is personalized from the get-go. You can utilize the filters to customize the information displayed in the Threat details tabs.

• Region — a searchable, multi-select list of countries with flags. Select any combination, or All regions.
• Industry — a single-select list of the 12 industry sectors, or All industries.

Below the filters, five KPI cards update as you change the selection:

The current tab, time range, and filter selection are reflected in the page URL, so any view you build can be shared with your team as a link.

The threat-object counters (Threat actors, Malwares, and the card grids) apply the region/industry filter when exactly one region and/or one industry is selected. With a multi-value selection they show the region- and industry-wide totals, while the IoCs and Latest attacks figures always honor the full multi-value selection.

Threat details tabs

These tabs show detailed information about the Latest Attacks, Threat Actors, Malwares, and Rules relevant to the your team context and the selected filter in the Explore the threats section. Explore the sections dedicated to each tab to learn in full detail all the information provided by the Threat Observatory.

Configure your Team Context

The Team Context is the set of countries where your team operates and the industry sectors you belong to. It drives everything in the Observatory: the KPIs, the default filters, and — if you create one — the custom feed.

The context belongs to the team, not to the individual user, so every team member sees the same personalized Observatory.

Follow the steps below to edit your team context.

1. Go to Profile > Team in the left navigation menu to access the I page.

2. Next to the Region or Industry chips, select the Edit icon to open Edit Team Context modal.

3. In Where does your team operate?, select all countries where you have offices, infrastructure, or customers.

4. In What industry are you in?, select all sectors your organization operates in.

5. Select Save context.

If your team already has a Threat Observatory feed, saving a new context automatically re-syncs the feed — its name and its query are updated to match the new region and industry selection.

Available industries

Automate your Threat Intelligence Feed

The Threat Observatory gives you the ability to turn your organization's context into an operational, always-up-to-date feed that will be catered specifically to the threats relevant to your company.

From the Who is targeting you? section, select Create custom feed. Then, a confirmation dialog summarizing your Team Context will appear.

Click Create feed and the feed will be created. It will start collecting all IoCs that match your team's region and industry context.

Notes on feed creation:

• The feed is named automatically: Threat Observatory - <COUNTRY CODES> - <Industry> (for example, Threat Observatory - MX - US - Financial Services).
• Creating the feed requires the team context to have at least one region or industry.
• The action is only available to team leaders on Enterprise plans. Saving the context alone never creates a feed — provisioning it is always an explicit action.
• If the feed already exists, the action simply re-synchronizes it.
• Right after creation, the feed content is generated by a background worker. It can take a few minutes for the indicators to show up in the Feeds module.

Threat Observatory feed activated

Once the feed has been created, the banner will display the following information of the created feed.

• A green Custom Feed Active indicator with the feed's name.
• View in Feeds — opens the feed's page in the Feeds module in a new tab.
• Total feed IoCs — the current feed size (same figure as IoCs ready to block).
• New IoCs today — how many of those indicators were added or updated in the last 24 hours.
• Last updated — feed content is recompiled continuously; the artifacts are refreshed roughly every 30 minutes.

From the Feeds module, the observatory feed behaves like any other Maltiverse feed: you can inspect its composition and content, download it, or integrate it with your firewall, EDR, SIEM, or TIP through the available connectors. Refer to Threat Intelligence Feeds Management and Create Custom Threat Intelligence Feeds for details.

View the MQL query

Before the feed is created, the banner also provides the View MQL query option. It opens a dialog with the Maltiverse Query Language filter behind your context, ready to copy or to open in the Search engine (Enterprise plans).

The query is a union: an indicator aimed at any of your countries or at your industry is relevant either way. You can refine it and use it as the base of a fully custom feed.

Latest Attacks tab

The default tab presents the Global Risk Pulse: live attack activity for your context, powered by the Lumu Defender real-time attack intelligence network — so you can see who is attacking whom, from where, and targeting which sectors, as it happens.

You can select the time range that controls every widget in this tab: Last 60 min, Today, Last 7 days, Last 30 days, and Last 365 days.

Top lists

Three ranked lists summarize the selected window:

• Top targeted regions — the countries receiving the most attacks, by IoC count.
• Top targeted industries — the sectors under heaviest fire.
• Top attackers sources — the countries where the attacking infrastructure is located.
  

Live Cyber Threat Map

The Live Cyber Threat Map animates recent attacks as arcs from source to target country, with the targeted countries highlighted. The INSIGHTS sidebar details the current attack: the indicator (linked to its IoC page), its classification, the source and target countries, and the targeted industry.

Selecting a country on the map applies it as a Region filter for the whole dashboard.

Latest Attacks table

A paginated, live view of the latest attacks matching your filters. Each row shows:

• Date — when the indicator was last seen active.
• Source — the country hosting the attacking infrastructure.
• Target — the targeted countries.
• Industry — the targeted sectors (icons).
• IP/Hostname — the indicator, linked to its full IoC page in Maltiverse.
• Classification — Malicious or Suspicious.

Distribution by Attribution Descriptions

This table ranks the attribution descriptions (blacklist descriptions such as Trojan.generic, Phishing, Cobalt Strike, TOR Node) most frequently seen across the data during the selected time frame, with occurrence counts and proportional bars. Use it to understand which threat families dominate your context and prioritize mitigations accordingly.

Threat Actors tab

The Threat Actors tab shows the actor groups targeting your selection as cards, ordered by their most recent IoC activity. Each card displays:

• The actor's name and MITRE ATT&CK group ID (for example, G0082 for APT38).
• Category tags such as Nation state, Criminal, or Espionage.
• IOCS RELATED — how many indicators in Maltiverse are attributed to the actor.
• LAST SEEN — how recently the actor's infrastructure was active.

Selecting a card opens the full Threat Actor profile in a new tab, keeping your dashboard state intact. Check out the Threat Actor and Malware profile section for more information.

Malwares tab

The Malwares tab presents the malware families targeting your selection with the same card layout: family icon, name, MITRE ATT&CK software ID (for example, S0650 for QakBot), type tags (Rat, Trojan, Credential stealer, Ransomware…), related IoC count, and last activity.

Selecting a card opens the full Malware profile in a new tab, keeping your dashboard state intact. Check out the Threat Actor and Malware profile section for more information.

Rules tab

The Rules tab turns context into detection engineering material. Coverage is derived from the most active malware families for your current selection.

YARA Rules

YARA rules are grouped by malware family, with the number of matching rules per family. From here you can:

• Expand a family to list its rules.
• Select the download icon on a family to download its rules as a .yar file.
• Select Download All .yar to download the whole set for your context as a single file.

Sigma Rules

Sigma rules are grouped by the MITRE ATT&CK technique they detect (for example, PowerShell, Ingress Tool Transfer), pooled across the context's malware families. The Push to SIEM button takes you to the Integrations module to wire detection content into your SIEM pipeline.

Rule detail panel

Selecting any rule opens a side panel with the full rule document:

• Name, severity (when available), and description.
• Metadata: author, source, license, dates.
• The complete rule content, with a Copy button.
• References to the original source.

Threat Actor and Malware profiles

Threat Actor and Malware profiles are full encyclopedia pages for each threat object. They are public pages — you can share their URLs with anyone, including recipients without a Maltiverse account (anonymous access is rate-limited):

The profiles provide the following information for both threat actors and malware.

• Hero — MITRE group ID, name, and the actor's known aliases.
• Fact strip — Threat type, First seen, Primary motivation, Sophistication, and Resource level.
• Targeting — the actor's origin country, targeted regions, and targeted industries.
• Relationships summary — a proportional bar of everything linked to the actor: techniques, malware, detection rules, campaigns, vulnerabilities, and related actors.
• Indicators Activity — a timeline of IoC sightings attributed to the actor, with the total of active IoCs and the last-seen date (visible to registered users). View the MQL query shows the query that pivots those indicators into Search (Enterprise plans).
• Context — the narrative description and tags.

Below, collapsible sections detail each relationship group:

Access tiers at a glance

Frequently asked questions

Related articles

• Getting Started with Maltiverse
• Threat Intelligence Feeds Management
• Create Custom Threat Intelligence Feeds
• Maltiverse Search Engine
• Maltiverse Plans