Silent Push Now Runs Inside Abstract Security
Silent Push data now runs inside Abstract Security. If your team uses Abstract, you can look up any domain or IP moving through your pipelines and investigations and get back who registered it, where it is hosted, what else sits on that address, and where it has been before. You can also run Threat Check against the stream, so a match on verified adversary infrastructure raises its own alert without anyone asking for it.
What you get back on a domain or IP
A domain shows up in a DNS log at two in the morning. The usual next twenty minutes go on tabs: WHOIS in one, a hosting lookup in another, passive DNS somewhere else, and the picture assembled by hand before anyone can say whether the domain matters. Abstract now calls Silent Push when the indicator appears and attaches the answers to the event itself.
Five actions are available, and between them they cover the questions an analyst actually asks:
- Who registered it and when. Registrar, creation and expiration dates, name servers, registrant details. A domain created eleven days ago, sitting behind privacy protection at a registrar you never otherwise see, is worth a closer look before anything else happens.
- Where it is hosted. ASN, hosting provider, geolocation and reputation, which is usually enough to tell ordinary hosting apart from the places adversaries keep going back to.
- What else is on that IP. Every other domain on the address, which is where shared hosting clusters and sibling infrastructure tied to the same actor show up.
- Where it lived before. Historical resolutions for the domain, so today’s indicator connects to activity you may have already triaged weeks ago under a different name.
- What else is being built to look like you. Query the Silent Push domain dataset by name pattern, registrar or name server to find lookalikes registered against your brand.
All of it comes back into the event in Abstract, so nobody has to open a second tool to go and find it.
Threat Check makes the pipeline a detection point
Threat Check is a lightweight enrichment solution that validates suspicious domains and IPs against Silent Push’s preemptive view of attacker infrastructure. Send it a domain, hostname or IP and it tells you whether that indicator is listed on a Silent Push Indicators of Future Attack® (IOFA) feed. The answer comes back as a true or false with a line of context, and the API has single and bulk endpoints, so it holds up against the volume a pipeline carries rather than only the indicators someone has already pulled out for review.
Abstract calls it in stream. A listed indicator is infrastructure Silent Push has already verified as adversary-owned and published to an IOFA feed, so what comes back is a verified answer the pipeline can act on without an analyst grading a score first. Abstract raises a detection on it where the data is, before any of it has reached the SIEM, and the enrichment actions fill in the context behind that alert.
The integration works in two directions. Alerts you already have come back with better answers, and verified adversary infrastructure moving through the stream creates alerts you would not otherwise have had.
Where the early visibility comes from
The Silent Push Context Graph continuously maps changing internet relationships and management patterns across global DNS, certificate, web scan and honeypot data. Adversary infrastructure gets built before it gets used, and the way it is registered, hosted and managed leaves a pattern while it is still being staged. Infrastructure identified at that stage is published to Silent Push IOFA feeds, which is what Threat Check queries.
On one documented Fortune 500 deployment, the lead time between Silent Push identifying infrastructure and that infrastructure being used averaged 104 days, with a median of 117 and some cases running past 200. The five enrichment actions draw on the wider Silent Push dataset, which also covers infrastructure already live in a campaign, so an enrichment hit is not automatically a pre-launch one. A Threat Check hit is, because the IOFA feeds are built from infrastructure caught during staging.
What this changes for SOC, IR and CTI teams
SOC. Threat Check runs across the pipeline, so verified adversary infrastructure raises its own alert. Everything else that comes in arrives enriched, which takes the research step out of triage and pulls down the queue of things nobody can rule out.
Incident response. Start from the indicator you have, run Domains on IP and IP history to find what else the actor is running, then search for name patterns to catch the rest of the set. Containment covers the infrastructure, not just the one host that tripped.
CTI. Map the full extent of a campaign from a single starting point, track lookalikes registered against the brand, and turn what you find into Abstract detections that fire the next time any of it appears.
Getting it running
The integration is available now to joint customers. It requires a Silent Push Enterprise Edition subscription. Setup takes only a few minutes in Abstract, and the steps are in the integration documentation can be found here.
If you are already an Abstract customer and want to see what Silent Push adds to your own stream before you commit, book a walkthrough with a Silent Push platform expert today.
