- Real time
- Victim attribution is automatically scrubbed
- False positives are automatically removed
- Data is consumable in multiple formats
- Syslog
- Stix / Taxii
- CSV via email
- CSV via HTTP / Web
- Data feed is customizable
- Two simple configurable data elements
- Hundreds of additional configuration elements