Recorded Future Constellation
Turn global network visibility into operational intelligence.
Invite-Only Offering
Query the internet on your terms.
Most network visibility solutions tell you what they think you should care about. Constellation lets you ask your own questions. Built on 150+ distributed sensors across 35+ countries processing billions of records daily, Constellation provides metadata-only network intelligence for IP addresses of interest— with the global visibility to see patterns no single vantage point can reveal.
Drive impact across threat operations.
Track adversary infrastructure at scale.
Track adversary infrastructure at scale.
Map command-and-control servers, botnet infrastructure, and malware distribution networks as they evolve. See how threat actors shift between IP ranges, rebuild after takedowns, and coordinate campaigns across geographic regions.
Accelerate incident response with outside-in context.
Accelerate incident response with outside-in context.
When your perimeter detects suspicious activity, query Constellation to understand what that IP has been doing globally. Distinguish between commodity scanning and targeted reconnaissance. Scope the threat before it becomes a breach.
Enrich investigations with high-fidelity context.
Enrich investigations with high-fidelity context.
Add depth to SOC alerts, active cases, and takedown decisions. Constellation delivers structured network traffic observations — source and destination IPs, ports, protocols, flow counts, and timestamps — that help analysts move from indicator to intelligence faster.
Build attribution that holds up.
Build attribution that holds up.
Administrative traffic analysis reveals how operators manage their infrastructure. Identify behavioral patterns connecting multiple servers, trace how infrastructure clusters and evolves across campaigns, and build attribution grounded in observed activity across hundreds of global vantage points.
Review Recent Insikt Group® Research - Produced Using Network Intelligence
Available with expert advisory services.
For organizations requiring deep operational expertise, the Global Network Intelligence Advisory pairs Constellation with forward-deployed analysts and embedded engineers. These dedicated experts work inside your SOC or intelligence fusion center, bringing the tradecraft to construct effective queries, interpret traffic patterns, and operationalize insights into defensive actions.
Critical for national cyber defense operations, critical infrastructure protection, and enterprise environments facing persistent, sophisticated adversaries.
FAQ
Your questions, answered.
What is Constellation?
Constellation is Recorded Future's Network Intelligence Query Capability that provides vetted organizations with access to global network traffic observations for specific IP addresses of interest. Powered by a distributed sensor network deployed across 35+ countries, Constellation supports threat infrastructure tracking, behavioral analysis, and global visibility into malicious activity while maintaining strict data minimization and other safeguards.
What problem does Constellation solve?
The primary challenge for threat researchers is visibility. Without global network intelligence, blind spots persist, adversaries move unchecked, and investigations stall. Internal telemetry alone is not enough. Constellation reduces those blind spots by providing metadata-only visibility into how IP addresses communicate across the internet, enabling you to track infrastructure, understand targeting, and support attribution-level investigations.
What's the difference between Constellation and traditional threat intelligence feeds?
Traditional threat intelligence feeds tell you what others have already found. Constellation lets you investigate what matters to your organization. Instead of consuming pre-packaged alerts, you submit your own IP selectors and receive comprehensive network traffic observations showing how those IPs behave globally. You ask your own questions and get answers specific to your mission.
How does Constellation maintain privacy and compliance?
Constellation is built on a metadata-only collection model, designed from the ground up to operate within strict safeguards. All use is governed by our Acceptable Use Policy.
How current is the data?
Constellation provides real-time data with hourly metadata updates, plus a rolling lookback window of up to 60 days. This enables both immediate investigation of current activity and longitudinal analysis to understand how infrastructure evolves over time.