> For the complete documentation index, see [llms.txt](https://shellzerox.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://shellzerox.gitbook.io/docs/monitoring-and-alerts/threat-intelligence-and-notifications.md).

# Threat Intelligence & Notifications

Understand how vulnerability intelligence and security notifications support threat awareness in SHELLZERO X.

***

### Overview

Threat intelligence helps security teams understand emerging vulnerabilities and identify information that may affect their systems.

SHELLZERO X incorporates vulnerability intelligence into its security assessment approach. Hunter focuses on checking detected software against newly confirmed exploited vulnerability information, helping users identify potential issues that warrant further investigation.

### Vulnerability Intelligence

Vulnerability intelligence provides information about known software weaknesses and evidence of exploitation.

Relevant information may include:

* Vulnerability identifiers, such as CVEs.
* Affected software and version ranges.
* Severity information where available.
* Evidence that a vulnerability is being exploited.
* Vendor advisories and available remediation guidance.

The relevance of a vulnerability depends on the software, version, configuration, and exposure of the affected system.

### How Hunter Supports Threat Awareness

Hunter is the running agent associated with exploited vulnerability intelligence.

Its intended workflow is to:

1. Use previously detected software information.
2. Recheck that information against available exploited vulnerability intelligence.
3. Identify potentially relevant matches.
4. Support further investigation and prioritization.

A match does not prove that a system is exploitable or compromised. Verify findings against authoritative vulnerability information and the actual environment.

### Notifications and Alerts

Security notifications can help users recognize findings or changes that require attention.

SHELLZERO X's published platform information references Telegram alerts as part of its scanning capabilities. The exact notification triggers, setup process, supported event types, and delivery options should be confirmed through the current platform interface.

| Notification Context       | Purpose                                                              |
| -------------------------- | -------------------------------------------------------------------- |
| Scan Findings              | Bring attention to identified security issues, where supported.      |
| Vulnerability Intelligence | Highlight potentially relevant vulnerability developments.           |
| Asset Changes              | Help users investigate changes when monitoring alerts are available. |
| Telegram Alerts            | Provide a notification channel where supported by the platform.      |

This table describes possible notification contexts, not a guarantee that every event type currently triggers an alert.

### Responding to a Security Alert

When you receive or identify a security notification:

1. Review the finding and its supporting evidence.
2. Identify the affected domain, asset, or software component.
3. Verify the information using a trusted source.
4. Assess the potential impact on your environment.
5. Prioritize corrective action based on severity and exposure.
6. Reassess the affected asset after remediation.

Avoid treating an alert as definitive proof of an active attack without additional evidence.

### Limitations

* Vulnerability intelligence may change as new information becomes available.
* Detected software information may be incomplete or inaccurate.
* Not every vulnerability affects every installation of a software product.
* Alert delivery depends on the notification functionality available and configured.
* Notifications cannot guarantee that every threat or security event will be detected.

Use threat intelligence as one input in a broader security monitoring and incident response process.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://shellzerox.gitbook.io/docs/monitoring-and-alerts/threat-intelligence-and-notifications.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.