PAGES
← all tools
◆ Threat Intelligence

Threat Command

commercial

Threat Command is a cybersecurity platform that monitors, detects, and responds to external threats across digital assets.

rss ↗ What is a cyber toolchain?

Summary

Threat Command is a commercial threat-intelligence platform, sold by Rapid7 and run as a SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. service, aimed at SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. analysts and threat-intel teams responsible for an organization's external exposure rather than its internal network. Beyond dark web monitoring, it packages several distinct modules: a Vulnerability Risk Analyzer that reprioritizes CVEs using its own clear-, deep-, and dark-web intelligence, a Threat Third Party module for tracking risk introduced by partners and vendors, and Phishing Watch, which looks for spoofed sites being staged before they go live against an organization's brand. Analysts can query alerts either through a guided basic mode or a dedicated query language, and a browser extension surfaces indicators and CVE context directly on any web page. It sits in the digital risk protection space alongside broader threat-intel platforms, and has been on the market since 2016.

Threat Command is a cybersecurity platform that monitors, detects, and responds to external threats across digital assets.

How Threat Command helps

Which of our leaked credentials or documents are being traded on the dark web right now?

scans surface, deep, and dark web sources continuously and raises an alert tied to the specific digital asset it matches, so analysts see exposure tied to their own organization rather than a generic feed

Which CVEs actually matter to our business instead of just the highest CVSS scores?

Vulnerability Risk Analyzer re-scores each CVE against its own clear-, deep-, and dark-web intelligence, letting analysts sort by relevance to their environment rather than the published severity alone

Is a phishing site impersonating our brand already being staged against us?

Phishing Watch looks for spoofed domains and sites being assembled before they go live and against the organization's brand, flagging them ahead of an active redirect campaign

Is a vendor or partner's exposure putting us at risk?

Threat Third Party extends the same monitoring to named third parties and surfaces threats aimed at them that could carry through to the organization

What do we know about an indicator or CVE we're looking at on any external web page?

the browser extension checks the page against the threat-intelligence database and surfaces matching indicators and CVE context directly on that page

What's the history of investigation and evidence on a given alert, even after it's closed?

analysts attach notes and documents to an alert, each stamped with the uploading user's name, and these stay attached to the alert record after it is closed or remediated

all 9 features, with the evidence for each →

Features

9 capabilities

Built from Threat Command's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What Threat Command offers you

  • Multi-tenant management1
  • Web management console1
All capabilities 9 capabilities
Alert Management and Investigation documented Provides capabilities to view, filter, search, prioritize, mark as read/unread, tag, flag, and perform bulk actions on alerts. 10 other sources · first seen Sep 2026

docs 10 total

  • DRP Quick Start Use the DRP Alerts . This is typically performed by the DRP administrator. Log in to Rapid7 Digital Risk Protection From the Command Platform home page, navigate to Alerts > Digital Risk Protection > DRP Alerts , and the pane**** are displayed alongside the alert. seen Sep 2026 · source
  • Threat details (Threat details are dynamic and may have changed since the alert was created. To view the current threat details, click the threat ID.) Alert ID (To copy the ID to the clipboard, click ) To view alert details: section, click the list icon. The alert details are displayed. seen Sep 2026 · source
  • , select an alert. , click the eye icon then select who to add. , select multiple alerts, as described in toolbar, click the eye icon then select who to add. , select an alert. , click the eye icon. seen Sep 2026 · source
  • alert header and the alert description alert banner shows information regarding the alert’s remediation status. If an alert can be remediated, the banner will feature a - for phishing, exposed services, and vulnerability alerts. - for credit cards for sale alerts. - for asset mentions in GitHub alerts. seen Sep 2026 · source
  • . Changing the severity level of alerts can help to prioritize alert management. , click the alert severity dropdown. , select multiple alerts, as described in toolbar, click the severity icon, then select the new severity level. seen Sep 2026 · source
  • You can mark an alert as read or unread. Unread alerts are indicated with a bold title on a white background. , they are unread. When you select an alert, it changes to read.  toolbar, click the ellipsis. Select either Mark as read or Mark as unread seen Sep 2026 · source
Collaboration and Case Management documented Enables internal and external collaboration through alert sharing via email, uploading documents, adding notes with replies, and contacting analysts. 4 other sources · first seen Sep 2026

docs

  • You can email alert details to others, whether they are inside or outside of your organization. Recipients can view the message details for 48 hours from the time it was sent. Comments that you send when sharing, as well as any replies from recipients, are displayed as part of the alert notes. seen Sep 2026 · source
  • You can upload documents to an alert that can be seen by internal users. Each document is accompanied by the name of the user who uploaded it. Alert documents remain with the alert, even after it is closed or otherwise remediated. You can also delete uploaded documents. docs update · Sep 2026 · source
  • You can send an alert inquiry to a Rapid7 intelligence analyst. panel, with the initials of the sender. When a reply is received, an envelope icon is displayed on the alert in the and the alert is updated. If the list is sorted by last-updated, the alert will appear at the top of the list. seen Sep 2026 · source
  • You can add notes, as text or uploaded files, to an alert that can be seen by internal users. Each note is accompanied by the name of the note creator. Other users can reply to notes. Alert notes remain with the alert, even after it is closed or otherwise remediated. docs update · Sep 2026 · source
Alert Life Cycle Management documented Allows users to assign alerts, change their status (e.g., closed), and rate them for intelligence improvements. 2 other sources

docs

  • - You can change an alert into this status to show that it is being managed. filter, closed alerts are not displayed. To see closed alerts, change the To change the status of a single alert: From the footer of the , click The rating is sent to the DRP team for future improvements. seen Sep 2026 · source
  • You can assign an alert to other Digital Rick Protection (DRP) users. When an alert is assigned, the assignee will receive a notification. , click the assignee icon, then select an assignee. , select multiple alerts, as described in toolbar, click the assignee icon, then select a new assignee. seen Sep 2026 · source
Threat Intelligence Monitoring documented Constantly monitors clear, deep, and dark web sources for threats related to the organization's assets using search engine piggybacking. 2 other sources

docs

  • Digital Risk Protection (DRP) performs constant threat intelligence monitoring across all web sources: clear web, deep web, and dark web. In addition, DRP utilizes “piggybacking” in existing search engines to gather further information. seen Sep 2026 · source
  • Digital Risk Protection This section describes the Rapid7 Digital Risk Protection capabilities. DRP Quick Start DRP includes the following capabilities: Remediating alert seen Sep 2026 · source
Threat Intelligence Sharing and Integration documented Exports Indicators of Compromise (IOCs) to SIEM and automation platforms for automated security actions. 1 other source · first seen Sep 2026

docs

  • Describes how to leverage synergies between Rapid7 Digital Risk Protection (DRP) and other Rapid7 products. Get IOC Data in SIEM & ICON to ‘get an indicator by value’ from the Threat Intelligence database from any page within SIEM or Automation. docs update · Sep 2026 · source
Blocklist and Remediation Actions documented Automatically adds IOCs related to a threat to an internal blocklist for feeding to security devices. 1 other source

docs

  • Go to Alerts > Digital Risk Protection > DRP Alerts Click on an alert from the alerts list.  section, click the IOCs icon. If the IOCs icon is not displayed, the selected alert is not a candidate for blocklist remediation. To add an IOC to the blocklist, hover over the IOC and click the seen Sep 2026 · source
Multi-Tenant Management documented Supports multi-tenant accounts that can navigate between customers from within the dashboard with a single login. 1 other source

Also counts toward: Multi-tenant management, Web management console

docs

  • Digital Risk Protection (DRP) multi-tenant accounts can navigate between their customers from within the dashboard, in the view of the customer (tenant), with just one login. The Strategic Intelligence module, all DRP pages, and the full ‘Policy’ options support multi-tenant management. seen Sep 2026 · source
Threat Analytics and Dashboards documented Displays and categorizes threats by type, severity, and source across web sources via a dedicated analytics dashboard. 1 other source

docs

  • Threat Analytics The Threat Analytics dashboard displays and categorizes threats by type and severity from across the clear, deep, and dark web. , by source type, severity, or type. You can click the pin icon in the main menu to pin or hide the menu. To view the alerts, click an alert heading. seen Sep 2026 · source
User Access and Authentication documented Manages user registration, login via email/credentials, and access to the dashboard. 1 other source

docs

  • Log in to Rapid7 Digital Risk Protection You can log in to Rapid7 Digital Risk Protection (DRP) using your email address and the credentials set up in the registration process. Log in using one of the following ways: The DRP Threat Analytics dashboard is displayed. seen Sep 2026 · source

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Release-note detail over time

See how much detail Threat Command puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

4 entries

  1. September 20264

    4 entries

    1. docs update Sep 15, 2026 · issue 075

      Threat Command alerts now support document attachments in PDF, CSV, DOC, DOCX, PNG, TXT, JPG, EML, and MSG formats⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

      └──▷ HOW TO FIND IT
      Attach an incident report or screenshot to an alert so your team retains evidence even after the alert is remediated.
      📍In the alert view, click the paperclip icon to open the document panel, then upload a PDF, PNG, or any supported file type. The document remains attached after the alert is closed.
      Bulk-attach a document (e.g. a CSV of IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself.) to several alerts at once during triage.
      📍In the alerts list, select multiple alerts, then in the toolbar click the ellipsis (...) and choose the paperclip icon to attach a supported file (CSV, DOC, DOCX, EML, JPEG, JPG, MSG, PDF, PNG, or TXT).
      • Supports bulk document attachment across multiple alerts via the ellipsis menu in the alert toolbar.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

      1 detail in Everything

    2. docs update Sep 15, 2026 · issue 075

      Threat Command: Attach files to alert notes via the paperclip icon, supporting CSV, DOC, DOCX, EML, JPEG, JPG, MSG, PDF, PNG, and TXT formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

      └──▷ HOW TO FIND IT
      Attach a threat intelligence report PDF to an alert note so analysts reviewing the closed alert later have full context.
      📍In the alert detail view, go to the Notes section, click the paperclip icon, and upload a PDF (or CSV, DOC, DOCX, EML, JPEG, JPG, MSG, PNG, or TXT file) to attach it to the note.
      • Copy existing alert notes using the copy icon.
      • Alert notes (text or file attachments) persist with an alert even after it is closed or remediated, and support threaded replies between internal users.

      2 details in Everything

    3. docs update Sep 15, 2026 · issue 075

      Threat Command DRP Alerts gains Query Mode with the DRP Query Language for complex, field-based alert searches.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

      └──▷ HOW TO FIND IT
      Search DRP Alerts for open alerts mentioning Dark Web or Exposed publicly discovered after a specific date, using Query Mode in the Command Platform.
      📍Navigate to Alerts › Digital Risk Protection › DRP Alerts. If the search bar shows a magnifying glass (Basic Mode), click the mode toggle to switch to Query Mode (confirmed by a green tick or red cross icon). Enter your DRPQL query — for example, to find non-closed alerts with specific keywords found after March 12th, 2020 — using field-based syntax with autocomplete suggestions. Use arrow keys and Enter to select suggestions, and click X in the search bar to cancel.
      • Adds Query Mode to the DRP Alerts search bar, enabling field-based searches using the DRP Query Language (DRPQL) with autocomplete suggestions — accessible from Alerts > Digital Risk Protection > DRP Alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
      • Supports complex DRPQL queries combining keyword matching in alert titles/descriptions, status filters (e.g. excluding closed alerts), and date-range filters (e.g. alerts found after a specific date).
      • Adds Query Mode to the DRP Alerts search bar, enabling field-based searches using the DRP Query Language (DRPQL) with autocomplete suggestions — accessible from Alerts > Digital Risk Protection > DRP Alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

      1 more in Everything

    4. docs update Sep 15, 2026 · issue 075

      Threat Command adds IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. enrichment pivot from SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. & ICON directly into the Threat Intelligence database.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

      └──▷ HOW TO FIND IT
      When investigating an alert in InsightIDR (SIEM) and you need to enrich a suspicious IOC, pivot directly to Threat Intelligence without leaving the platform.
      📍In InsightIDR or ICON, open any alert or automation workflow, then select 'get an indicator by value' to query the Threat Intelligence database. (Requires an active DRP connection with Threat Intelligence enabled.)
      • Enables users to query 'get an indicator by value' from the Threat Intelligence database directly from any page within SIEM or Automation (ICON), pivoting IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. tied to alerts without leaving the Rapid7 Insight platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

      1 detail in Everything

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback