Documentation

Tables

81
live schema

Feed categories

138

Platforms

hub →
all dashboards

API

docs →
REST + TAXII

📕 Getting Started

  1. Run the DB upgrades in order: upgrade-db.php → v3 → v4 → v5 → v6 → v7 → v8.
  2. Seed reference data: countries, sources, world borders.
  3. Ingest: Auto-Collect or Import.
  4. Resolve locally: Resolve Everything.
  5. Automate: schedule cron.php (collect→ingest→resolve→enrich→score→alert).
  6. Operate: Platforms Hub, Copilot, AI Skills.

📚 Tradecraft Glossary

OSINT — Open-source intelligence
GEOINT — Geospatial intelligence
SIGINT — Signals intelligence
HUMINT — Human intelligence
FININT — Financial intelligence
SOCMINT — Social-media intelligence
TECHINT — Technical intelligence
AIS — Automated Indicator Sharing (CISA)
STIX — Structured Threat Info Expression
TAXII — CTI transport protocol
IoC — Indicator of Compromise
TTP — Tactics, Techniques & Procedures
APT — Advanced Persistent Threat

🔌 Source Catalog

IP Blocklists (323) IP Reputation (24) Phishing (15) Sanctions (13) APT/IoC (11) C2 Attribution (10) Reputation (9) CERT Advisories (8) OSINT (8) Domains/URLs (7) Vulnerabilities (7) Malware (6) Vulnerability (6) Crypto (5) Ransomware (5) TECHINT (5) C2 (5) Malware Hashes (5) Malware Attribution (5) Wanted (4) DNS (4) Malware URLs (4) Cryptocurrency (4) ASN (4) FININT: Sanctions (4) Geopolitical (4) Adverse Media (3) Catalog: Critical Infrastructure (3) Tor (3) Malware Domains (3) Advisory (3) Framework (3) Scam (3) Catalog: Conflict & Humanitarian (3) Catalog: Risk Analysis (3) Breach (2) Catalog: APT (2) Crypto: Blockchain Explorer (2) Malware Families (2) Ransomware Actors (2) Threat Actors (2) Catalog: CERTINT (2) Catalog: Logistics (2) Catalog: Operational Security (2) Proxy/Anon (2) Catalog: Mining & Resource Crime (2) Crypto Sanctions (2) Disinformation (2) Catalog: Academic (2) Catalog: CORPINT (2) Court Cases (2) Governance (2) Corporate Registry (2) Maritime (2) ATT&CK Actors (2) Catalog: Reference (2) Dark Web (2) Armed Conflict (2) C2 Certificates (2) Crypto: Crypto Phishing (2) Nation State (2) Ransom Payments (1) Sharing (1) Catalog: CRYPTINT (1) Catalog: Emerging Tech (1) Catalog: LEGINT (1) Catalog: NETINT (1) Catalog: RF/Space (1) Catalog: SOCMINT (1) FININT: Securities Regulator (1) Vuln Mapping (1) ATT&CK (1) Catalog: ACADINT (1) Catalog: Counterfeiting (1) Catalog: DOMINT (1) Catalog: Human Trafficking (1) Catalog: MEDINT (1) Catalog: PATENTINT (1) Catalog: SANCINT (1) Catalog: Vehicle (1) FININT: Legal Entity (1) Human Trafficking (1) PEP Screening (1) Catalog: Dark Web (1) Catalog: EPIINT (1) Catalog: Risk (1) Catalog: SUPPLYINT (1) Corporate/Legal (1) Crypto: Crypto Fraud (1) Environmental (1) Geolocation (1) Mobile ATT&CK (1) Scanning (1) Aviation (1) Catalog: ACTORINT (1) Catalog: ELECTINT (1) Catalog: Insider Threat (1) Catalog: REFINT (1) Catalog: Social (1) Catalog: VULNINT (1) FININT: Sanctions/PEP (1) ICS ATT&CK (1) Malware IPs (1) Catalog: Domain (1) Catalog: GEOINT (1) Catalog: Maritime Piracy (1) Catalog: PASTINT (1) Catalog: RISKINT (1) Catalog: Threat Analysis (1) Crypto: Crypto Sanctions (1) FININT: Enforcement (1) Wildlife Crime (1) Catalog: AVINT (1) Catalog: CYBINT (1) Catalog: Environmental Crime (1) Catalog: LOGINT (1) Catalog: NEWSINT (1) Catalog: RFINT (1) Catalog: SPACEINT (1) Crypto: Crypto Attribution (1) Catalog: ACCTINT (1) Catalog: Criminal (1) Catalog: ECONINT (1) Catalog: Identity (1) Catalog: METOCINT (1) Catalog: SIGINT (1) Catalog: VEHINT (1) Crypto Fraud (1) Humanitarian (1) Refugee/Migration (1) Threat Reports (1) Catalog: DARKINT (1) Catalog: Forced Labour (1) Catalog: MALINT (1) Catalog: OSINT (1) Catalog: TECHINT (1) Counterterrorism (1) FININT: Adverse Media (1)

Add more via Seed Sources.

🗃 Data Dictionary (81 tables)

TableApprox rows
activity_log109
alerts400
alert_rules10
api_keys0
asn_contacts69
asn_intel0
attack_groups176
attack_software825
attack_techniques697
attribution_map2.7M
campaigns26
campaign_indicators0
cases137
case_entities148
case_evidence269
case_indicators8
case_notes0
class_rules14
country_actor0
country_case0
country_corridor0
country_gap0
country_legal0
country_metric0
country_org0
country_source0
country_unit0
crypto_attribution18
cve_intel1.6K
detection_rules0
dns_records10K
domain_spec33
enrichments156.9K
entity_link0
entity_links19.7K
evidence_log0
feed_registry638
human_security565
humint_sources32
indicators1.2M
indicator_sources2.1M
indicator_tags3.2M
ingest_queue1
intel_disciplines0
ioc_rollup0
ip_dataset_imports0
ip_intel0
ip_ranges0
job_runs1
kv_cache640
legal_requests0
mission_domains0
narratives64
netflow0
net_log834
passive_dns3.1K
platform_log1
playbook_runs0
ransomware_decryptors18
ransomware_groups20
ransomware_victims162
risk_history0
sanctions20
saved_searches35
sectors8
settings34
social_posts0
sources302
source_catalog247
source_health0
statistics0
stat_rollup0
tags53
takedown_requests0
tip_reports250
triage_state0
user_api_keys0
watchlists5
watchlist_items5
website_tech0
whois_cache798
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

⚡ AI Skills

All SkillsResolveEnrichCorrelateSummarize

🔍 Lookup & Enrich

EnrichmentsPivotLink Analysis

📚 Docs & Reports

DocumentationGenerate ReportAPIPlatforms Hub

💡 Recommendations

⚙ Automation

Operations Center

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook

🔗 Related Tools

Mission CommandAdvanced SearchOperations Center