Threatera

Your encryption key — who can open this organisation's samples

Event forwarding — push findings to a webhook or your SIEM

Everything else here flows in. This is the way out: a finding lands in the queue your team already watches instead of waiting to be noticed on this screen. Webhooks are signed, and a syslog sink speaks CEF, which every SIEM parses. A webhook must point somewhere externally routable — an address inside this cluster is refused, when you save it and again before every delivery.

Reporting mailbox — a phishing@ mailbox this organisation already has Refresh

Messages are marked read and left in place — nothing is deleted from your mailbox, and no reply is ever sent. Everything that arrives here is analysed, including senders and anyone quoted in a forwarded thread, so agree a retention period before you enable it.

Intel subscriptions — TAXII 2.1 collections and MISP instances you receive from Refresh

Polled hourly. The request says only "everything added since <timestamp>" — it names no indicator, hash or file, so the publisher learns nothing about what you hold. What arrives shows up as enrichment on the indicator page and is swept by the watchlist. Markings are carried through: exporting a case that contains TLP:AMBER intelligence stamps the bundle with that marking rather than dropping it.

Endpoint protection — pull in what your own EDR blocked Refresh

Connect your Microsoft Defender, CrowdStrike Falcon or Cortex XDR tenancy and what your endpoints blocked arrives here hourly, without anybody deciding to send it. This only ever pulls. Every request goes to your own EDR, with a credential you issued, and what comes back is your data returning to you — nothing about your estate is sent anywhere.

You can pause any source here, and pausing takes effect at once — it stops the hourly poll without losing your place, so resuming picks up from where it stopped rather than starting over. Connecting a tenancy and resuming a paused one are done by Threatera, because those are what make this platform call your endpoints on a schedule.

Blocked on your endpoints — newest first

A record of what your endpoint protection stopped, which survives your own console's retention. The verdict stays in the vendor's words — it is their finding, not ours, and restating it as one of ours would launder it. Sample says whether the file itself is held here: every vendor describes a detection, only some of them will hand over the bytes, so knowing about something and having it are different states.

Single sign-on — let your own identity provider decide who gets in

People type their address on the sign-in screen and are sent to your provider instead of a password box. Anything your directory enforces — MFA, conditional access, disabling a leaver — starts applying here, and an account created this way has no password on this platform at all. Sign-in is routed by email domain, so the domains below decide both who is sent to this provider and which addresses it is allowed to speak for.

Data retention — how long each kind of data is kept

Everything is kept indefinitely until you set a period here — leaving a box empty means exactly that, and nothing is ever removed on its own. A nightly job applies these; nothing is deleted the moment you save. Anything attached to a case is never removed, however old, so setting a period cannot quietly gut an investigation you have already written up.

API keys in this organisation — every key, whoever issued it

An API key carries the role of whoever created it, so this is part of the answer to "who can reach our data" — and a key issued by an analyst who has since left is exactly the credential nobody remembers. You can see that a key exists and end it; you cannot read it. Nobody can: only a 12-character prefix and a hash are stored.