In short: Cisco Talos is Cisco's threat intelligence and research group. It writes the Snort intrusion rules used by Secure Firewall, supplies the reputation and malware intelligence behind Secure Email, Secure Endpoint, Secure Access and XDR, and feeds Splunk Enterprise Security. Talos also publishes free reputation lookups, open-source tools, vulnerability research and a public blog.
What is Cisco Talos?
Talos is the threat intelligence organisation inside Cisco. It was formed by bringing together Sourcefire's Vulnerability Research Team, which created the Snort rule sets, with Cisco's Threat Research and Communications group and its Security Applications group. Today it works across several disciplines:
- Threat research: tracking malware families, threat actors and campaigns
- Detection engineering: writing IPS rules, antivirus signatures and detection content for Cisco products
- Reputation and categorisation: scoring IP addresses, domains and URLs, and sorting websites into content categories
- Vulnerability research: finding flaws in third-party software and disclosing them to vendors
- Incident response: the separate Cisco Talos Incident Response service for organisations dealing with a breach
Talos draws on telemetry from across Cisco's networking, endpoint, email, web and cloud products. You do not buy "Talos" as a product for detection content; you get its intelligence through the Cisco products you already subscribe to.
How Talos intelligence reaches Cisco products
| Product | What Talos provides |
|---|---|
| Cisco Secure Firewall | Snort 3 intrusion rules, Security Intelligence block lists for IPs, URLs and domains, and URL categories (with the IPS, URL Filtering and Malware Defense licences) |
| Cisco Security Cloud Control | AIOps insights that link active threat campaigns to Talos resources, alongside Talos rule updates for the firewalls it manages |
| Cisco Secure Email | Sender and URL reputation, anti-spam and outbreak filter intelligence for the gateway, and threat intelligence behind Secure Email Threat Defense |
| Cisco Secure Endpoint | Malware detections and file reputation; Premier adds threat hunting by Talos analysts |
| Cisco Secure Access and Cisco Umbrella | Domain and URL reputation and content categories for DNS and web security |
| Cisco Secure Web Appliance | Web reputation and URL filtering |
| Cisco XDR | Threat intelligence used to enrich and prioritise incidents |
| Splunk Enterprise Security | From version 8.4, Talos enrichment of IP addresses, domains, URLs and file hashes on an investigation's intelligence tab |
Because the same intelligence is shared, an indicator Talos identifies can be blocked at the firewall, the DNS layer, the email gateway and the endpoint without each product having to discover it separately. Keeping subscriptions current matters: an expired IPS or URL Filtering licence on a firewall means it stops receiving new Talos updates.
Snort and the Talos rule sets
Snort is the open-source intrusion prevention engine that Cisco inherited with Sourcefire, and Snort 3 is the engine inside Secure Firewall Threat Defense (current Threat Defense releases run Snort 3 only). Talos writes and maintains the rules it uses, and its data also trains SnortML, the machine-learning engine in Threat Defense that looks for exploit patterns rather than waiting for a signature.
For the open-source community, Talos publishes rules in tiers: a community rule set, a free registered tier, and a paid subscriber tier that receives new rules as soon as they are released, 30 days before registered users. The subscriber rule set is the one Talos develops for Cisco's own IPS customers. Secure Firewall customers with an IPS licence receive Talos rule updates through the product itself, so there is nothing separate to buy for the firewall.
Talos also maintains ClamAV, the open-source antivirus engine, and publishes other free tools for researchers and defenders on its website.
Free Talos resources you can use today
- Reputation lookups: the Talos Intelligence Center lets anyone search the reputation of an IP address or domain and see email and spam trends
- Disputes: if a legitimate site or mail server is miscategorised or blocked, requests go through the Talos support site rather than the incident response team
- Vulnerability reports: Talos discloses vulnerabilities it finds and publishes coverage of Microsoft's monthly security updates
- The Talos blog and Threat Source newsletter: write-ups of campaigns, malware and threat actor activity, plus the Talos podcasts
- Open-source tools: Snort, ClamAV and a range of analysis tools and decryptors
These are useful for any security team, Cisco customer or not. For UK organisations, Talos research sits well alongside guidance and alerts from the NCSC.
Talos Incident Response
Talos also runs Cisco Talos Incident Response, a retainer and emergency response service. A retainer can cover emergency response, readiness assessments, incident response plan reviews, tabletop exercises and threat hunting. Talos IR services are included in the Premier tier of the Breach Protection Suite, and selected Talos IR services form part of Cisco XDR Premier.
How we help
We make sure the Talos intelligence you are paying for is actually switched on and doing its job: IPS policies tuned and updating on your firewalls, Security Intelligence feeds enabled, email reputation filtering configured, and alerts flowing into Cisco XDR or Splunk. If a supplier or customer is being blocked by a Talos reputation score, we help you investigate and raise a dispute. Contact us for a review of your Cisco security configuration.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Cisco Talos?
Cisco Talos is Cisco's threat intelligence and research group. It analyses threats and vulnerabilities and turns the results into IPS rules, reputation data and detections used across Cisco security products, and publishes research and free tools.
Is Cisco Talos free?
Some of it is. The reputation lookups, blog, newsletter, vulnerability reports, Snort community rules and ClamAV are free. The intelligence inside Cisco products comes with those products' subscriptions, and Talos Incident Response is a paid service.
How do I check an IP or domain reputation with Talos?
Use the reputation search in the Talos Intelligence Center on talosintelligence.com. Enter the IP address or domain to see Talos's view of it, including its email and web reputation.
How do I get a website or mail server unblocked by Talos?
Raise a reputation or categorisation dispute through the Talos support site. The Talos incident response team does not handle these requests. We can help gather the evidence and submit the dispute on your behalf.
Does Talos write the rules for Cisco Secure Firewall?
Yes. Talos writes the Snort intrusion rules and the Security Intelligence feeds used by Secure Firewall Threat Defense. Firewalls with a current IPS licence receive rule updates automatically.