Team Cymru RADAR Adds One-Click Pivots to Scout for Threat Hunting
Summary
Team Cymru says RADAR can pivot selected IPs or CIDR ranges into automatically generated Scout queries, surfacing recent NetFlow, PassiveDNS and certificate activity and tagged malicious-IP communications for threat hunting and attribution.
Key points
- RADAR can generate and launch Scout queries from selected IP addresses, address groups or CIDR ranges.
- The queries can surface recent NetFlow, PassiveDNS and certificate activity related to discovered infrastructure.
- Scout results include tagged malicious IPs that analysts can filter and investigate.
- Analysts can examine communications data for potential command-and-control patterns and shared infrastructure between campaigns.
Article Details
- Event Type
- Team Cymru announced RADAR's pivot feature, which automatically generates and launches investigation queries in Scout from selected IP addresses or CIDR ranges.
- Impact
- The feature connects RADAR discoveries with PureSignal telemetry, including recent NetFlow, PassiveDNS, and certificate activity, helping analysts identify malicious communications and potential command-and-control patterns more quickly. Existing Team Cymru Recon or Scout customers were offered complimentary RADAR access through January 31, 2026.
Vendors
Products
PureSignalUsing Team Cymru’s PureSignal data, the largest source of context-rich telemetry beyond the network edge, RADAR allows organizations to carry out threat hunting and attribution by connecting discovered infrastructureRADARThat’s where RADAR’s pivot feature steps in. With a click of a button, analysts can automatically generate prebuilt queries in Scout or Recon based on selected IPs or CIDR ranges in RADAR for deeper investigations. ReconThat’s where RADAR’s pivot feature steps in. With a click of a button, analysts can automatically generate prebuilt queries in Scout or Recon based on selected IPs or CIDR ranges in RADAR for deeper investigations. ScoutThat’s where RADAR’s pivot feature steps in. With a click of a button, analysts can automatically generate prebuilt queries in Scout or Recon based on selected IPs or CIDR ranges in RADAR for deeper investigations.