ELLIO

ELLIO's Deception Network records internet-wide scanning, vulnerability probing and exploitation attempts against IPv4 space. This connector gives Claude direct access to those observations over a rolling 90-day window, together with your organization's EDL Management rulesets, so investigations and blocking decisions rest on current evidence rather than static reputation lists.

With it, Claude can:

• Triage an IP address: classification, observed behaviors, CVEs and ATT&CK techniques, the IP Activity Forecast, network owner and abuse contact, cloud and SaaS context from Common Business Services, reverse DNS, and whether your rules already cover it.
• Search and break down observations with ELLIO Query Language (ELQ), by ASN, country, CVE, behavior tag, HTTP path, user agent, and JA4 or MuonFP fingerprint.
• Find trending Atlas tags and show a tag's activity over time, to catch new exploitation campaigns and scanning waves early.
• Explain any behavior tag, ATT&CK technique, CVE (including known-exploited status) or business services category.
• Review EDL Management rulesets, rules and firewall deployments, and add, extend or remove IPs.