HIIH Findings, retrieved where your security teams already work.
Pull-based delivery: you retrieve intelligence on your terms. Investigate in HIIH for full engagement context, or have your existing tools pull structured Findings through the API and authorized MCP paths; STIX 2.1 over TAXII 2.1 is available by engagement. HIIH adds a target-side intelligence source without asking you to replace your security stack.
Use HIIH for depth. Use your existing stack for operations.
The Surface Console gives analysts a place to inspect engagements, timelines, Findings, related observations, artifacts and available replays. It is not intended to replace the customer’s SIEM, XDR, SOAR, ticketing or CTI platform. HIIH exposes a concise operational representation for existing workflows to retrieve, and preserves a route back to the richer context.
| Layer | Role |
|---|---|
| HIIH Surface Console | understand the engagement and inspect context |
| Existing SOC platform | triage, correlate, ticket and respond |
| External CTI / production telemetry | add broader context and confirm relevance |
Not every integration provides a one-click deep link or fully synchronized case state; those are set up per deployment.
One source, several operational uses.
By engagement or deployment, and only where the path is set up for it: briefings · CTI or detection material · MISP-compatible feed / IOC list / CERT-oriented outputs · partner reporting.
“Delivery” has three levels, and not every level is automated in every deployment:
| Level | What it means |
|---|---|
| Representation | a concise alert or event your tools retrieve |
| Investigation access | retrieve richer context and supporting material |
| Intelligence product | briefing, detection content or other analyzed output |
Delivery is described in three short chapters. Read them in order, or jump to what you are integrating.
Start with the workflow that matters.
A HIIH integration discussion should begin with one operational question, one Surface pattern, one Finding type and one destination. The objective is to prove that useful target-side intelligence reaches the team that can act on it.