📕 Getting Started
- Run the DB upgrades in order:
upgrade-db.php→ v3 → v4 → v5 → v6 → v7 → v8. - Seed reference data: countries, sources, world borders.
- Ingest: Auto-Collect or Import.
- Resolve locally: Resolve Everything.
- Automate: schedule
cron.php(collect→ingest→resolve→enrich→score→alert). - Operate: Platforms Hub, Copilot, AI Skills.
📚 Tradecraft Glossary
OSINT — Open-source intelligence
GEOINT — Geospatial intelligence
SIGINT — Signals intelligence
HUMINT — Human intelligence
FININT — Financial intelligence
SOCMINT — Social-media intelligence
TECHINT — Technical intelligence
AIS — Automated Indicator Sharing (CISA)
STIX — Structured Threat Info Expression
TAXII — CTI transport protocol
IoC — Indicator of Compromise
TTP — Tactics, Techniques & Procedures
APT — Advanced Persistent Threat
🔌 Source Catalog
IP Blocklists (323) IP Reputation (24) Phishing (15) Sanctions (13) APT/IoC (11) C2 Attribution (10) Reputation (9) CERT Advisories (8) OSINT (8) Vulnerabilities (7) Domains/URLs (7) Malware (6) Vulnerability (6) Malware Hashes (5) Crypto (5) Malware Attribution (5) TECHINT (5) C2 (5) Ransomware (5) DNS (4) Cryptocurrency (4) Geopolitical (4) Wanted (4) Malware URLs (4) ASN (4) Scam (3) Adverse Media (3) Tor (3) Malware Domains (3) Advisory (3) Framework (3) ATT&CK Actors (2) Crypto: Blockchain Explorer (2) Armed Conflict (2) C2 Certificates (2) Nation State (2) Breach (2) Catalog: Logistics (2) Crypto Sanctions (2) Disinformation (2) Malware Families (2) Threat Actors (2) Court Cases (2) Ransomware Actors (2) Corporate Registry (2) Proxy/Anon (2) Catalog: Academic (2) Dark Web (2) Governance (2) Catalog: Reference (2) Crypto: Crypto Phishing (2) Maritime (2) Catalog: Domain (1) Humanitarian (1) Refugee/Migration (1) Threat Reports (1) Catalog: Risk (1) Sharing (1) Corporate/Legal (1) Crypto: Crypto Fraud (1) Environmental (1) Ransom Payments (1) Vuln Mapping (1) ATT&CK (1) Catalog: Criminal (1) Catalog: Vehicle (1) Human Trafficking (1) PEP Screening (1) Catalog: RF/Space (1) Crypto: Crypto Sanctions (1) Geolocation (1) Mobile ATT&CK (1) Scanning (1) Aviation (1) Catalog: Identity (1) Crypto: Crypto Attribution (1) ICS ATT&CK (1) Malware IPs (1) Catalog: Social (1) Crypto Fraud (1) Wildlife Crime (1) Counterterrorism (1)
Add more via Seed Sources.
🗃 Data Dictionary (54 tables)
| Table | Approx rows |
|---|---|
activity_log | 109 |
alerts | 0 |
alert_rules | 10 |
api_keys | 0 |
asn_contacts | 69 |
attack_groups | 176 |
attack_software | 825 |
attack_techniques | 697 |
attribution_map | 2.7M |
campaigns | 26 |
cases | 17 |
case_entities | 23 |
case_evidence | 36 |
case_indicators | 10 |
case_notes | 0 |
crypto_attribution | 18 |
cve_intel | 1.6K |
detection_rules | 0 |
dns_records | 4.9K |
enrichments | 1.6K |
entity_links | 19.7K |
feed_registry | 591 |
human_security | 565 |
indicators | 1.1M |
indicator_sources | 2.1M |
indicator_tags | 3.2M |
ingest_queue | 1 |
intel_disciplines | 0 |
ip_dataset_imports | 0 |
ip_ranges | 0 |
job_runs | 1 |
kv_cache | 349 |
legal_requests | 0 |
mission_domains | 0 |
narratives | 64 |
net_log | 834 |
platform_log | 235 |
playbook_runs | 0 |
ransomware_victims | 153 |
sanctions | 20 |
saved_searches | 0 |
sectors | 8 |
settings | 31 |
sources | 302 |
source_catalog | 60 |
statistics | 0 |
tags | 53 |
takedown_requests | 0 |
tip_reports | 250 |
triage_state | 0 |
watchlists | 5 |
watchlist_items | 5 |
website_tech | 0 |
whois_cache | 49 |
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports
🤖 AI Copilot
⚡ AI Skills
🔍 Lookup & Enrich
📚 Docs & Reports
💡 Recommendations
- Explore related tools below
- Automate recurring work via cron