- Real-time
- Victim attribution is automatically scrubbed
- False positives are automatically reduced/removed
- Data is consumable in multiple formats
- Syslog
- Stix / Taxii
- CSV via HTTP / Web
- The data feed is customizable
- Two simple configurable data elements
- Hundreds of additional configuration elements