📕 Getting Started
- Run the DB upgrades in order:
upgrade-db.php→ v3 → v4 → v5 → v6 → v7 → v8. - Seed reference data: countries, sources, world borders.
- Ingest: Auto-Collect or Import.
- Resolve locally: Resolve Everything.
- Automate: schedule
cron.php(collect→ingest→resolve→enrich→score→alert). - Operate: Platforms Hub, Copilot, AI Skills.
📚 Tradecraft Glossary
OSINT — Open-source intelligence
GEOINT — Geospatial intelligence
SIGINT — Signals intelligence
HUMINT — Human intelligence
FININT — Financial intelligence
SOCMINT — Social-media intelligence
TECHINT — Technical intelligence
AIS — Automated Indicator Sharing (CISA)
STIX — Structured Threat Info Expression
TAXII — CTI transport protocol
IoC — Indicator of Compromise
TTP — Tactics, Techniques & Procedures
APT — Advanced Persistent Threat
🔌 Source Catalog
IP Blocklists (323) IP Reputation (24) Phishing (15) Sanctions (13) APT/IoC (11) C2 Attribution (10) Reputation (9) CERT Advisories (8) OSINT (8) Domains/URLs (7) Vulnerabilities (7) Malware (6) Vulnerability (6) Malware Attribution (5) C2 (5) Crypto (5) Ransomware (5) TECHINT (5) Malware Hashes (5) Geopolitical (4) Malware URLs (4) Wanted (4) DNS (4) Cryptocurrency (4) FININT: Sanctions (4) ASN (4) Catalog: Risk Analysis (3) Advisory (3) Catalog: Critical Infrastructure (3) Catalog: Conflict & Humanitarian (3) Adverse Media (3) Malware Domains (3) Tor (3) Framework (3) Scam (3) Court Cases (2) Nation State (2) Corporate Registry (2) FININT: Securities Regulator (2) ATT&CK Actors (2) Catalog: Reference (2) Dark Web (2) Malware Families (2) Armed Conflict (2) C2 Certificates (2) Crypto: Crypto Phishing (2) Ransomware Actors (2) Threat Actors (2) Breach (2) Crypto: Blockchain Explorer (2) Proxy/Anon (2) Catalog: APT (2) Catalog: Operational Security (2) Governance (2) Catalog: Logistics (2) Maritime (2) Crypto Sanctions (2) Disinformation (2) Catalog: Academic (2) Catalog: Mining & Resource Crime (2) Crypto: Crypto Sanctions (1) FININT: Court Records (1) Refugee/Migration (1) Threat Reports (1) Catalog: Insider Threat (1) Crypto: Crypto Attribution (1) Ransom Payments (1) Sharing (1) Catalog: Forced Labour (1) Catalog: Threat Analysis (1) Crypto Fraud (1) FININT: Legal Entity (1) Human Trafficking (1) PEP Screening (1) Vuln Mapping (1) Catalog: Domain (1) Catalog: Maritime Piracy (1) Counterterrorism (1) FININT: Adverse Media (1) Geolocation (1) Mobile ATT&CK (1) Catalog: Criminal (1) Catalog: Identity (1) Catalog: Risk (1) FININT: Sanctions/PEP (1) ICS ATT&CK (1) Malware IPs (1) Scanning (1) ATT&CK (1) Catalog: Environmental Crime (1) Catalog: Social (1) FININT: Enforcement (1) Catalog: Dark Web (1) Corporate/Legal (1) Crypto: Crypto Fraud (1) Environmental (1) Wildlife Crime (1) Aviation (1) Catalog: Counterfeiting (1) Catalog: Human Trafficking (1) Catalog: RF/Space (1) Catalog: Vehicle (1) Humanitarian (1) Catalog: Emerging Tech (1)
Add more via Seed Sources.
🗃 Data Dictionary (54 tables)
| Table | Approx rows |
|---|---|
activity_log | 109 |
alerts | 400 |
alert_rules | 10 |
api_keys | 0 |
asn_contacts | 69 |
attack_groups | 176 |
attack_software | 825 |
attack_techniques | 697 |
attribution_map | 2.7M |
campaigns | 26 |
cases | 137 |
case_entities | 148 |
case_evidence | 269 |
case_indicators | 8 |
case_notes | 0 |
crypto_attribution | 18 |
cve_intel | 1.6K |
detection_rules | 0 |
dns_records | 9.7K |
enrichments | 1.6K |
entity_links | 19.7K |
feed_registry | 626 |
human_security | 565 |
indicators | 1.2M |
indicator_sources | 2.1M |
indicator_tags | 3.2M |
ingest_queue | 1 |
intel_disciplines | 0 |
ip_dataset_imports | 0 |
ip_ranges | 0 |
job_runs | 1 |
kv_cache | 524 |
legal_requests | 0 |
mission_domains | 0 |
narratives | 64 |
net_log | 834 |
platform_log | 234 |
playbook_runs | 0 |
ransomware_victims | 162 |
sanctions | 20 |
saved_searches | 0 |
sectors | 8 |
settings | 32 |
sources | 302 |
source_catalog | 192 |
statistics | 0 |
tags | 53 |
takedown_requests | 0 |
tip_reports | 250 |
triage_state | 0 |
watchlists | 5 |
watchlist_items | 5 |
website_tech | 0 |
whois_cache | 580 |
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports
🤖 AI Copilot
⚡ AI Skills
🔍 Lookup & Enrich
📚 Docs & Reports
💡 Recommendations
- Explore related tools below
- Automate recurring work via cron