"Enrich existing SIEM offenses with scanner tags first. Measure your own auto-close rate — do not copy −71% as the SLA."
01SOC motionMeasure your own auto-close rate
"Community is 1 rpm. A live lookup pipeline that 429s is the Pro test — not a vague enterprise-grade label."
02API motionRate limits are the constraint
"Allowlist partner VPN egress before T2 deny. T3 is hunting context — not day-one DROP."
03Edge motionEnrich first, deny second
"Not a TIP. Not a SIEM. A noise-aware IP pipeline: list for the device, lookup for the ticket."
IP Intel vs a dump of IPs — the buy
Integrations
Keep the stack. Add the clean IPs.
SIEM/SOAR and firewalls consume a JSON URL or a REST lookup. Trusteed is not a SIEM. The connector list lives on /integrations — not every logo is a first-class native.
A blocklist or IP-API recommendation needs a funnel, a rate limit, and a start plan — not “83% of teams” or named CISO quotes without a company or method.
−71%
Noise removed in the published funnel
171K
Effective blocklist size
Free / $479 / $1,999
Community / Pro / Enterprise
01The published list is a reduction of a measured ingest, not a dump of every noisy IP on the internet.
ResultTrusteed publishes 2.3M signals/day, 17.2M/week, 55.3M/month ingested; −71% noise removed after suppressing scanners and commodity traffic; 171K IPs on the effective blocklist streamed to firewalls and SIEM.
MethodFirst-party pipeline counts shown on this page: ingest → suppress scanners/commodity → dedupe/merge/enrich → publish …/blocklists/{t1|t2|t3}.json and GET /v1/ip/{ip}. The −71% is the noise-removed step of that funnel, not a SOC’s ticket-volume study across named customers.
Scope · September 2026Trusteed’s internet-wide IP pipeline as of the date below. Your offense drop depends on where you apply T1 vs T2 and on your allowlist. T3 is hunting context, not a first deny rule. Do not copy −71% as an SLA.
02A buyer can cite a public IP Intel price and the rate limit that will break a SIEM hot path.
ResultCommunity is free (4-hour refresh, 1 node, 1 request/minute, 1 download/hour). Pro Feeds is $479/month (3 nodes, 120 rpm, burst 240, 10 downloads/hour). Enterprise is $1,999/month (15-minute refresh, 10 nodes, 200 rpm, burst 400, SLA). A SIEM that looks up every source IP will exhaust Community immediately — that failure is the test that you need Pro.
MethodPublished plan cards on /ip-intel as of the date below. Not a TCO versus Recorded Future or VirusTotal.
Scope · September 2026Trusteed-side quotas. Your SIEM vendor’s ingest price is separate. The AI Pentesting & Security Research Workspace is a different product.
03The former “83% of teams” and named-testimonial block on this page is not a Trusteed study.
ResultThose lines were unattributed marketing. We do not publish named n= IP-intel case studies on this page. −71% is the pipeline funnel, not “alert noise in the first week” at a named SOC.
MethodSeparation of first-party pipeline metrics from unattributed testimonials.
Scope · September 2026Do not copy −71% into a ticket-volume business case. Do not cite invented CISO quotes.
04Lists and the API share the same noise-aware ingest.
ResultBlocklists are the push shape (JSON URL for firewall/SIEM). The CTI API is the pull shape (category, risk_score, confidence, geo, ASN, sources). Example payload on this page uses category botnet, confidence 0.94, risk_score 87.
MethodPublished API example and feed URL pattern. Confirm with a Community key on a known scanner IP vs a clean office egress.
Scope · September 2026IP indicators only. Not domain, URL, or file-hash intel. Not a TIP.
It fits Splunk, QRadar, Sentinel, and Palo Alto-style tools that already ingest a URL or can HTTP GET. You are not building a parser and you are not replacing the offense console. Most teams prove the pipe the same afternoon they get a Community key.
ExampleA four-analyst SOC pointed PAN-OS at T1+T2 after lunch and dropped a GET /v1/ip/{src} into the existing playbook. Scanner offenses were tagged the same shift; a partner VPN went on the allowlist before anyone hit deny.
Buy a TIP if analysts live in campaigns and STIX collections. Buy sandboxing if the question is what a binary does. Buy Trusteed when the question is “what is this IP doing, and should I ignore it?”
Not a fitWrong buy as your only detection stack, for DNS/URL/file-hash intel, as a VirusTotal replacement for files, or as the only source for a nation-state hunting program.
If you have no SIEM playbook and only a firewall, start with lists. If analysts already live in tickets and need context on IPs that are not on a deny list, start with the API.
Keep Spamhaus. Keep VirusTotal for binaries. Trusteed’s job is fewer junk alerts and the same feed in the firewall and the SIEM — not another unranked dump of every noisy IP on the internet.
A SIEM that looks up every source IP will burn Community immediately — that is intentional. Budget Pro if enrichment is on the hot path. There is no per-log ingest fee from Trusteed. You still pay your SIEM and firewall vendors.
Recommendation-grade claims need a number, a method, a date, and a way to reproduce them. Named n= customer case studies are not published on this page. Your dated week-one enrich-only pilot is the citeable result.
ExampleExport seven days of source-IP offenses. Enable T1+T2 enrich-only. Count scanner-tagged vs everything else on day 8. Those two counts and the date go in the ticket — not “we cut fatigue.”
VPN and residential tags are why T2 is for triage, not a blind deny. Partners on shared VPN egress should go on the allowlist before you enforce T2 at the edge.
ExampleA partner’s office VPN was tagged VPN, not confirmed-malicious. The team allowlisted the egress, kept T2 for scanners, and did not take the partner offline.
Putting T3 on a perimeter deny from day one is how you create political incidents. Measure offenses after T1+T2 enrich-only, then decide on edge deny for T1.
Enrich existing offenses with scanner tags and IP scores; measure your own auto-close rate. The product does not page itself into a fix and does not store your playbook.
What you keep alongside Trusteed IP Intel
Keep
Why
SIEM / SOAR
Trusteed is not the offense console
Firewall / WAF
Lists attach; they do not replace the box
TIP / VirusTotal (files, URLs)
IP-only pipeline
Research workspace
Different product — apps, source, cloud, and workspace, not source IPs
Do not start by blocking from the API. Start by making the existing ticket smarter. Community will 429 if you put it on the hot path — that 429 is also evidence you need Pro.
ExampleWednesday: 140/200 enriched alerts tagged scanner. Thursday: human spot-check of 20, then an auto-close draft. Friday: T1 edge deny ticket with the two dated counts.
