AI agents do more than write code. They run commands, touch files, resolve URLs, and reach the network. Most SOC tooling was not built to watch that execution surface.
Today that surface becomes easier to defend. Threat Landscape threat intelligence is now integrated with Ecliptica Replay, the local-first AI Detection and Response (AIDR) platform from Ecliptica Labs.
Replay watches what agents do. Threat Landscape tells you when those actions touch infrastructure that is already known to be hostile.
Why AIDR needs threat intelligence
AIDR is detection and response for the AI stack: prompts, tools, agents, and the systems they can reach. It is not "EDR with a model bolted on." The thing being protected is the agent itself.
An agent can:
- probe cloud metadata endpoints
- read credentials from local files or environment variables
- pull packages or payloads from unexpected hosts
- exfiltrate source, secrets, or customer data over HTTP
- follow a poisoned instruction that looks like a normal coding task
Behavioral rules catch a lot of this. They flag cloud metadata probes, credential access, and unexpected egress as they happen, but they cannot tell you on their own whether the destination is already tracked as malware infrastructure, a paste site, a C2 host, or part of an active campaign. Threat intelligence supplies that missing context.
What the integration does
Replay sits between the agent and the system. It records tool calls, commands, files, and URLs. Detection rules run locally. You can stay monitor-only or opt into blocking per rule.
On top of that local telemetry, Replay now correlates observed domains, IPs, URLs, and file hashes against the Threat Landscape feed. When an agent reaches a known-bad host or a tracked indicator, the alert arrives with context instead of as an anonymous network event.
In practice, an alert can go from "The agent fetched something from this domain" to "The agent fetched something from infrastructure already present in Threat Landscape intelligence."
Replay still reconstructs the full session from saved history: every tool call, command, and file, in order. The intel match is context on that timeline, not a separate ticket that someone has to pivot into a TIP to understand.
Nothing about this changes Replay's design. It stays free and local-first. Activity stays on the machine in a single local history. Nothing leaves unless you say so. Threat Landscape correlation adds context to what Replay already sees; it does not turn the endpoint into a cloud collector.
Why this pairing works
Threat Landscape and Replay are built by the same team, Ecliptica Labs, but they solve different layers of the same problem.
| Layer | Product | Role |
|---|---|---|
| Intelligence | Threat Landscape | Gather OSINT and darknet signals, strip noise, and structure high-value intel as native STIX 2.1: actors, campaigns, malware, TTPs, ATT&CK mappings, and IOCs. |
| Runtime | Ecliptica Replay | Watch AI agents on the machine, detect suspicious behavior as it happens, optionally block it, and rebuild the session for investigation. |
Most teams already pipe Threat Landscape into a TIP, SIEM, SOAR, or XDR through REST, TAXII 2.1, or MCP. Replay extends that same intelligence to the place where coding agents actually execute: Claude Code, Codex, Gemini CLI, Cursor, Windsurf, GitHub Copilot, and a growing list of other agent runtimes.
That gives you a closed loop:
- Threat Landscape continuously structures emerging infrastructure and indicators.
- Replay observes live agent activity on the endpoint.
- Matches surface as enriched alerts with a replayable session attached.
- Analysts investigate the behavior, not a raw IOC dump.
What security teams can do with it
For SOC and detection, treat agent sessions like network sessions. When Replay flags unexpected egress or a metadata probe, the Threat Landscape match tells you whether the destination is already known, and session replay gives you the evidence trail for triage.
Platform and DevOps teams can inventory the agents on a machine, verify they are actually reporting, and apply local rules without standing up another cloud control plane.
For compliance and IR, keep an audit-ready local history of what agents touched. When an incident review starts, you have the timeline and the intel context in one place.
Individual developers can use Replay free for non-commercial use. You can watch your own agents the same way you would watch a network, without creating an account or sending telemetry.
Commercial and enterprise use of Replay is available through Ecliptica Labs. Enterprise adds central visibility and rule orchestration while the detection engine stays local.
Get started
If you already use Threat Landscape, Replay is the runtime layer for the agents now sitting next to your engineers.
If you already use Replay, Threat Landscape is the structured intelligence behind the "known-bad" match on domains, IPs, URLs, and hashes.
- Try Replay
- Explore Threat Landscape, including the free tier
- Pipe intel into the rest of the stack via API, TAXII, or MCP
We would like to hear how this lands in your agent workflow.
Threat Landscape turns global OSINT and darknet signals into structured intelligence so analysts can act faster.