A threat report rarely ends with the report. A domain, an IP, a hash, or a CVE is usually the start of the next question: where else has this appeared, what is it tied to, and is anyone else tracking it?
Until now, answering that meant copying the value, opening a browser tab, and repeating the same search across several sites. Pivots remove that loop.
What pivots are
Pivots are one-click external lookups attached to the machine-readable entities in our intelligence. When a tag is a real indicator, it gets a small arrow. Click it and a menu opens with a curated set of public research destinations for that value.
Supported entity types:
- CVE identifiers
- Adversary technique and tactic IDs
- Domains
- IPv4 and IPv6 addresses
- URLs
- MD5, SHA-1, and SHA-256 hashes
Each destination opens in a new tab. The value is carried across automatically, so there is nothing to copy, paste, or reformat.
Where you will see them
Pivots are built into the places where analysts already read intelligence.
Event tags. Supported tags in reader, card, and table views carry a small external arrow. The tag text still performs the internal search. The arrow opens the external menu. One control for context, one for the wider record.
Event details. The Pivots button in the report header opens a side panel with every pivotable entity in that report. You can filter the list, select specific entities, copy the selection, or open the selected entities in one pass.
Indicators library. Each row has an arrow for a direct lookup, and the expanded row includes an External Lookups action with the same menu.
Keyless by design
The part we care about most is what you do not have to do.
There are no third-party API keys to request, no accounts to connect, and no configuration before the first lookup. Pivots are generated from a fixed allowlist of public research services, and every value is URL-encoded before it leaves the platform. If a tag is not a reliable machine-readable entity, it does not get a pivot.
That constraint is deliberate. A pivot should be predictable: same entity type, same set of destinations, no surprises from user-supplied URLs.
Available on free accounts
Pivots are not a paid add-on. Free accounts get the same pivot menus on events and reports, with the same destination set and the same side panel.
Paid accounts also get pivots across the Indicators library, where the underlying indicator data lives.
Why this matters for analysts
The work of threat intelligence is mostly context switching. A report says a vulnerability is being exploited. The next step is a vulnerability record, then exploitation status, then exposure. A report names a domain. The next step is reputation, registration history, and what the infrastructure looks like today.
Each of those steps is small. Together they are the difference between reading a report and investigating it.
Pivots shorten the distance. They do not replace analyst judgment, and they do not turn an external result into a verdict. They give you a fast, consistent starting point from the indicator you already have.
One entity, one click
Pivots are live now across events, reports, and the Indicators library. Open a report, pick a supported entity, and follow it outward.