📕 Getting Started
- Run the DB upgrades in order:
upgrade-db.php→ v3 → v4 → v5 → v6 → v7 → v8. - Seed reference data: countries, sources, world borders.
- Ingest: Auto-Collect or Import.
- Resolve locally: Resolve Everything.
- Automate: schedule
cron.php(collect→ingest→resolve→enrich→score→alert). - Operate: Platforms Hub, Copilot, AI Skills.
📚 Tradecraft Glossary
OSINT — Open-source intelligence
GEOINT — Geospatial intelligence
SIGINT — Signals intelligence
HUMINT — Human intelligence
FININT — Financial intelligence
SOCMINT — Social-media intelligence
TECHINT — Technical intelligence
AIS — Automated Indicator Sharing (CISA)
STIX — Structured Threat Info Expression
TAXII — CTI transport protocol
IoC — Indicator of Compromise
TTP — Tactics, Techniques & Procedures
APT — Advanced Persistent Threat
🔌 Source Catalog
IP Blocklists (323) IP Reputation (24) Phishing (15) Sanctions (13) APT/IoC (11) C2 Attribution (10) Reputation (9) CERT Advisories (8) OSINT (8) Domains/URLs (7) Vulnerabilities (7) Malware (6) Vulnerability (6) Malware Attribution (5) C2 (5) Crypto (5) Ransomware (5) TECHINT (5) Malware Hashes (5) Geopolitical (4) Malware URLs (4) ASN (4) Catalog: Conflict & Humanitarian (4) DNS (4) Wanted (4) Cryptocurrency (4) Catalog: APT (4) FININT: Sanctions (4) Catalog: Risk Analysis (3) Advisory (3) Catalog: Critical Infrastructure (3) Malware Domains (3) Adverse Media (3) Framework (3) Scam (3) Catalog: Dark Web (2) Catalog: Logistics (2) Court Cases (2) Tor (2) Catalog: Reference (2) Corporate Registry (2) FININT: Securities Regulator (2) Catalog: Academic (2) Catalog: Mining & Resource Crime (2) Dark Web (2) Malware Families (2) Crypto: Crypto Phishing (2) Ransomware Actors (2) Catalog: Operational Security (2) Crypto: Blockchain Explorer (2) Proxy/Anon (2) C2 Certificates (2) Governance (2) Breach (2) Maritime (2) Catalog: Nation State (2) Crypto Sanctions (2) Disinformation (2) Crypto: Crypto Sanctions (1) FININT: Court Records (1) Nation State (1) Refugee/Migration (1) Aviation (1) Catalog: Counterfeiting (1) Catalog: Human Trafficking (1) Crypto: Crypto Attribution (1) Ransom Payments (1) Sharing (1) Wildlife Crime (1) Catalog: Emerging Tech (1) Catalog: Threat Analysis (1) Crypto Fraud (1) FININT: Legal Entity (1) Human Trafficking (1) PEP Screening (1) Catalog: Insider Threat (1) Catalog: Risk (1) Counterterrorism (1) FININT: Adverse Media (1) Geolocation (1) Mobile ATT&CK (1) Threat Reports (1) ATT&CK Actors (1) Catalog: Forced Labour (1) FININT: Sanctions/PEP (1) ICS ATT&CK (1) Malware IPs (1) Scanning (1) Armed Conflict (1) Catalog: Domain (1) Catalog: Maritime Piracy (1) Catalog: Social (1) FININT: Enforcement (1) Vuln Mapping (1) Catalog: Criminal (1) Catalog: Identity (1) Catalog: RF/Space (1) Corporate/Legal (1) Crypto: Crypto Fraud (1) Environmental (1) ATT&CK (1) Catalog: Environmental Crime (1) Catalog: Vehicle (1) Humanitarian (1)
Add more via Seed Sources.
🗃 Data Dictionary (54 tables)
| Table | Approx rows |
|---|---|
activity_log | 109 |
alerts | 0 |
alert_rules | 10 |
api_keys | 0 |
asn_contacts | 69 |
attack_groups | 176 |
attack_software | 825 |
attack_techniques | 697 |
attribution_map | 2.7M |
campaigns | 26 |
cases | 130 |
case_entities | 136 |
case_evidence | 262 |
case_indicators | 10 |
case_notes | 0 |
crypto_attribution | 18 |
cve_intel | 1.6K |
detection_rules | 0 |
dns_records | 9.2K |
enrichments | 1.7K |
entity_links | 20K |
feed_registry | 626 |
human_security | 565 |
indicators | 1.1M |
indicator_sources | 2.1M |
indicator_tags | 3.2M |
ingest_queue | 1 |
intel_disciplines | 0 |
ip_dataset_imports | 0 |
ip_ranges | 0 |
job_runs | 1 |
kv_cache | 473 |
legal_requests | 0 |
mission_domains | 0 |
narratives | 64 |
net_log | 834 |
platform_log | 235 |
playbook_runs | 0 |
ransomware_victims | 153 |
sanctions | 20 |
saved_searches | 0 |
sectors | 8 |
settings | 33 |
sources | 302 |
source_catalog | 192 |
statistics | 0 |
tags | 51 |
takedown_requests | 0 |
tip_reports | 250 |
triage_state | 0 |
watchlists | 5 |
watchlist_items | 5 |
website_tech | 0 |
whois_cache | 426 |
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports
🤖 AI Copilot
⚡ AI Skills
🔍 Lookup & Enrich
📚 Docs & Reports
💡 Recommendations
- Explore related tools below
- Automate recurring work via cron