Documentation

Tables

75
live schema

Feed categories

138

Platforms

hub →
all dashboards

API

docs →
REST + TAXII

📕 Getting Started

  1. Run the DB upgrades in order: upgrade-db.php → v3 → v4 → v5 → v6 → v7 → v8.
  2. Seed reference data: countries, sources, world borders.
  3. Ingest: Auto-Collect or Import.
  4. Resolve locally: Resolve Everything.
  5. Automate: schedule cron.php (collect→ingest→resolve→enrich→score→alert).
  6. Operate: Platforms Hub, Copilot, AI Skills.

📚 Tradecraft Glossary

OSINT — Open-source intelligence
GEOINT — Geospatial intelligence
SIGINT — Signals intelligence
HUMINT — Human intelligence
FININT — Financial intelligence
SOCMINT — Social-media intelligence
TECHINT — Technical intelligence
AIS — Automated Indicator Sharing (CISA)
STIX — Structured Threat Info Expression
TAXII — CTI transport protocol
IoC — Indicator of Compromise
TTP — Tactics, Techniques & Procedures
APT — Advanced Persistent Threat

🔌 Source Catalog

IP Blocklists (323) IP Reputation (24) Phishing (15) Sanctions (13) APT/IoC (11) C2 Attribution (10) Reputation (9) CERT Advisories (8) OSINT (8) Vulnerabilities (7) Domains/URLs (7) Malware (6) Vulnerability (6) Malware Hashes (5) Malware Attribution (5) Crypto (5) Ransomware (5) TECHINT (5) C2 (5) FININT: Sanctions (4) Geopolitical (4) DNS (4) Malware URLs (4) Wanted (4) Cryptocurrency (4) ASN (4) Scam (3) Catalog: Risk Analysis (3) Catalog: Conflict & Humanitarian (3) Adverse Media (3) Catalog: Critical Infrastructure (3) Malware Domains (3) Tor (3) Framework (3) Advisory (3) Dark Web (2) ATT&CK Actors (2) Catalog: Reference (2) Crypto: Crypto Phishing (2) Nation State (2) Armed Conflict (2) C2 Certificates (2) Crypto: Blockchain Explorer (2) Breach (2) Catalog: APT (2) Malware Families (2) Ransomware Actors (2) Threat Actors (2) Catalog: CERTINT (2) Catalog: Logistics (2) Catalog: Operational Security (2) Crypto Sanctions (2) Disinformation (2) Proxy/Anon (2) Catalog: Mining & Resource Crime (2) Court Cases (2) Governance (2) Catalog: Academic (2) Catalog: CORPINT (2) Corporate Registry (2) Maritime (2) Catalog: SIGINT (1) Catalog: VEHINT (1) Crypto Fraud (1) Humanitarian (1) Catalog: ACCTINT (1) Catalog: Criminal (1) Catalog: ECONINT (1) Catalog: Identity (1) Catalog: METOCINT (1) Catalog: TECHINT (1) Counterterrorism (1) FININT: Adverse Media (1) Refugee/Migration (1) Threat Reports (1) Catalog: DARKINT (1) Catalog: Forced Labour (1) Catalog: MALINT (1) Catalog: OSINT (1) Catalog: RF/Space (1) Catalog: SOCMINT (1) FININT: Securities Regulator (1) Ransom Payments (1) Sharing (1) Catalog: CRYPTINT (1) Catalog: Emerging Tech (1) Catalog: LEGINT (1) Catalog: NETINT (1) Catalog: SANCINT (1) Catalog: Vehicle (1) FININT: Legal Entity (1) Human Trafficking (1) PEP Screening (1) Vuln Mapping (1) ATT&CK (1) Catalog: ACADINT (1) Catalog: Counterfeiting (1) Catalog: DOMINT (1) Catalog: Human Trafficking (1) Catalog: MEDINT (1) Catalog: PATENTINT (1) Catalog: Risk (1) Catalog: SUPPLYINT (1) Corporate/Legal (1) Crypto: Crypto Fraud (1) Environmental (1) Geolocation (1) Mobile ATT&CK (1) Catalog: Dark Web (1) Catalog: EPIINT (1) Catalog: Social (1) Catalog: VULNINT (1) FININT: Sanctions/PEP (1) ICS ATT&CK (1) Malware IPs (1) Scanning (1) Aviation (1) Catalog: ACTORINT (1) Catalog: ELECTINT (1) Catalog: Insider Threat (1) Catalog: REFINT (1) Catalog: RISKINT (1) Catalog: Threat Analysis (1) Crypto: Crypto Sanctions (1) FININT: Enforcement (1) Catalog: Domain (1) Catalog: GEOINT (1) Catalog: Maritime Piracy (1) Catalog: PASTINT (1) Catalog: RFINT (1) Catalog: SPACEINT (1) Crypto: Crypto Attribution (1) Wildlife Crime (1) Catalog: AVINT (1) Catalog: CYBINT (1) Catalog: Environmental Crime (1) Catalog: LOGINT (1) Catalog: NEWSINT (1)

Add more via Seed Sources.

🗃 Data Dictionary (75 tables)

TableApprox rows
activity_log109
alerts400
alert_rules10
api_keys0
asn_contacts69
asn_intel0
attack_groups176
attack_software825
attack_techniques697
attribution_map2.7M
campaigns26
cases137
case_entities148
case_evidence269
case_indicators8
case_notes0
class_rules14
country_actor0
country_case0
country_corridor0
country_gap0
country_legal0
country_metric0
country_org0
country_source0
country_unit0
crypto_attribution18
cve_intel1.6K
detection_rules0
dns_records9.9K
domain_spec33
enrichments1.6K
entity_link0
entity_links19.7K
evidence_log0
feed_registry661
human_security565
indicators1.2M
indicator_sources2.1M
indicator_tags3.2M
ingest_queue1
intel_disciplines0
ioc_rollup0
ip_dataset_imports0
ip_intel0
ip_ranges0
job_runs1
kv_cache594
legal_requests0
mission_domains0
narratives64
net_log834
platform_log234
playbook_runs0
ransomware_decryptors18
ransomware_groups20
ransomware_victims162
sanctions20
saved_searches35
sectors8
settings32
sources302
source_catalog247
source_health0
statistics0
stat_rollup0
tags53
takedown_requests0
tip_reports250
triage_state0
user_api_keys0
watchlists5
watchlist_items5
website_tech0
whois_cache770
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

⚡ AI Skills

All SkillsResolveEnrichCorrelateSummarize

🔍 Lookup & Enrich

EnrichmentsPivotLink Analysis

📚 Docs & Reports

DocumentationGenerate ReportAPIPlatforms Hub

💡 Recommendations

⚙ Automation

Operations Center

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook

🔗 Related Tools

Mission CommandAdvanced SearchOperations Center