All plans include the core enrichment engine, MITRE ATT&CK mapping, and REST API access. Volume-based IOC pricing scales with your alert environment — not your analyst headcount.
For small in-house security teams running under 5,000 IOC enrichments per month.
For dedicated SOC teams processing 25,000+ IOCs monthly with SOAR automation.
For MSSPs and enterprise environments with multi-tenant requirements and volume SLAs.
Annual billing available at 15% discount on Starter and Professional plans. IOC enrichment counts reset monthly. Overage rates: $0.04 per enrichment on Starter, $0.02 on Professional.
| Feature | Starter | Professional | Enterprise |
|---|---|---|---|
| IOC enrichment volume | 5,000/mo | 25,000/mo | Unlimited |
| Threat feed integrations | 20+ | 40+ | 40+ + private |
| MITRE ATT&CK coverage | Enterprise | Enterprise + ICS + Mobile | Full matrix |
| SOAR connectors | — | Splunk, XSOAR, Tines | All + custom |
| YARA/Sigma generation | — | ||
| STIX 2.1 / TAXII 2.1 | — | ||
| Tenant isolation | — | — | |
| Custom data residency | — | — | |
| Support SLA | 48h email | 4h priority | Dedicated TAM |
Professional plan includes a 14-day free trial with no credit card required. You get access to all Professional features including SOAR connectors and YARA/Sigma generation. Trial accounts are limited to 1,000 IOC enrichments during the trial period.
One enrichment = one IOC processed through the full pipeline, regardless of how many threat feeds return data for that indicator. Bulk API calls count each IOC in the request separately. Cached results (indicators enriched within the past 4 hours) do not count against your monthly quota.
IOCs submitted for enrichment are not shared with other tenants. Professional and Enterprise plans include explicit data isolation controls. Enterprise customers can request a Data Processing Agreement (DPA) for SOC 2 and GDPR compliance requirements. All data transmitted over TLS 1.3; data at rest encrypted AES-256.
Splunk and Elastic integrations average 3 minutes using the native connector wizard. Microsoft Sentinel requires a Logic App deployment (automated, approximately 8 minutes). Custom SOAR platforms using the REST API typically take under 30 minutes with our integration documentation. Professional plan customers get a 1-hour onboarding call with a solutions engineer.
Upgrades take effect immediately and are prorated for the remaining billing period. Downgrades take effect at the next renewal date. Annual plans can be upgraded at any time; downgrade requests for annual plans are processed at contract renewal.