Documentation

📚 Help — countries

ISO-3166 registry with a per-country dossier: indicators, sanctions, wanted subjects, human-security indices and risk trend. Seed offline via seed-countries.php.

Tables

51
live schema

Feed categories

72

Platforms

hub →
all dashboards

API

docs →
REST + TAXII

📕 Getting Started

  1. Run the DB upgrades in order: upgrade-db.php → v3 → v4 → v5 → v6 → v7 → v8.
  2. Seed reference data: countries, sources, world borders.
  3. Ingest: Auto-Collect or Import.
  4. Resolve locally: Resolve Everything.
  5. Automate: schedule cron.php (collect→ingest→resolve→enrich→score→alert).
  6. Operate: Platforms Hub, Copilot, AI Skills.

📚 Tradecraft Glossary

OSINT — Open-source intelligence
GEOINT — Geospatial intelligence
SIGINT — Signals intelligence
HUMINT — Human intelligence
FININT — Financial intelligence
SOCMINT — Social-media intelligence
TECHINT — Technical intelligence
AIS — Automated Indicator Sharing (CISA)
STIX — Structured Threat Info Expression
TAXII — CTI transport protocol
IoC — Indicator of Compromise
TTP — Tactics, Techniques & Procedures
APT — Advanced Persistent Threat

🔌 Source Catalog

IP Blocklists (305) IP Reputation (24) Phishing (15) Sanctions (13) C2 Attribution (10) Reputation (9) APT/IoC (8) OSINT (8) CERT Advisories (8) Domains/URLs (7) Vulnerabilities (7) Malware (6) Vulnerability (6) C2 (5) Crypto (5) Malware Attribution (5) Ransomware (5) TECHINT (5) Cryptocurrency (4) Geopolitical (4) Wanted (4) Malware URLs (4) ASN (4) DNS (4) Malware Hashes (4) Advisory (3) Adverse Media (3) Tor (3) Malware Domains (3) Framework (3) Scam (3) Nation State (2) ATT&CK Actors (2) Armed Conflict (2) C2 Certificates (2) Crypto Sanctions (2) Disinformation (2) Malware Families (2) Ransomware Actors (2) Threat Actors (2) Breach (2) Court Cases (2) Proxy/Anon (2) Corporate Registry (2) Dark Web (2) Governance (2) Crypto: Crypto Phishing (2) Maritime (2) Crypto: Blockchain Explorer (2) Refugee/Migration (1) Threat Reports (1) Ransom Payments (1) Sharing (1) Corporate/Legal (1) Crypto: Crypto Fraud (1) Environmental (1) Vuln Mapping (1) Human Trafficking (1) PEP Screening (1) Crypto: Crypto Sanctions (1) Geolocation (1) Mobile ATT&CK (1) Scanning (1) ATT&CK (1) Crypto: Crypto Attribution (1) ICS ATT&CK (1) Malware IPs (1) Crypto Fraud (1) Wildlife Crime (1) Aviation (1) Counterterrorism (1) Humanitarian (1)

Add more via Seed Sources.

🗃 Data Dictionary (51 tables)

TableApprox rows
activity_log109
alerts0
alert_rules5
api_keys0
asn_contacts69
attack_groups176
attack_software825
attack_techniques697
attribution_map2.7M
campaigns26
cases16
case_entities22
case_evidence34
case_indicators10
case_notes0
crypto_attribution18
cve_intel1.6K
detection_rules0
dns_records4.7K
enrichments1.6K
entity_links19.7K
feed_registry556
human_security565
indicators1.1M
indicator_sources2.1M
indicator_tags3.2M
ingest_queue1
intel_disciplines0
ip_dataset_imports0
ip_ranges0
job_runs1
kv_cache323
legal_requests0
mission_domains0
narratives64
net_log834
platform_log235
playbook_runs0
ransomware_victims153
sanctions20
saved_searches0
settings31
sources302
source_catalog21
statistics0
tags53
tip_reports250
triage_state0
watchlists5
watchlist_items5
website_tech0
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

⚡ AI Skills

All SkillsResolveEnrichCorrelateSummarize

🔍 Lookup & Enrich

EnrichmentsPivotLink Analysis

📚 Docs & Reports

DocumentationGenerate ReportAPIPlatforms Hub

💡 Recommendations

⚙ Automation

Operations Center

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook

🔗 Related Tools

Mission CommandAdvanced SearchOperations Center