Documentation

Tables

84
live schema

Feed categories

138

Platforms

hub →
all dashboards

API

docs →
REST + TAXII

📕 Getting Started

  1. Run the DB upgrades in order: upgrade-db.php → v3 → v4 → v5 → v6 → v7 → v8.
  2. Seed reference data: countries, sources, world borders.
  3. Ingest: Auto-Collect or Import.
  4. Resolve locally: Resolve Everything.
  5. Automate: schedule cron.php (collect→ingest→resolve→enrich→score→alert).
  6. Operate: Platforms Hub, Copilot, AI Skills.

📚 Tradecraft Glossary

OSINT — Open-source intelligence
GEOINT — Geospatial intelligence
SIGINT — Signals intelligence
HUMINT — Human intelligence
FININT — Financial intelligence
SOCMINT — Social-media intelligence
TECHINT — Technical intelligence
AIS — Automated Indicator Sharing (CISA)
STIX — Structured Threat Info Expression
TAXII — CTI transport protocol
IoC — Indicator of Compromise
TTP — Tactics, Techniques & Procedures
APT — Advanced Persistent Threat

🔌 Source Catalog

IP Blocklists (323) IP Reputation (25) Phishing (15) Sanctions (13) APT/IoC (11) C2 Attribution (10) OSINT (10) CERT Advisories (8) Reputation (8) Domains/URLs (7) Vulnerabilities (7) Vulnerability (6) Crypto (5) Malware (5) Ransomware (5) TECHINT (5) Malware Hashes (5) Malware Attribution (5) DNS (4) Malware URLs (4) Wanted (4) Cryptocurrency (4) ASN (4) C2 (4) FININT: Sanctions (4) Geopolitical (4) Adverse Media (3) Catalog: Critical Infrastructure (3) Malware Domains (3) Tor (3) Framework (3) Advisory (3) Scam (3) Catalog: Conflict & Humanitarian (3) Catalog: Risk Analysis (3) Breach (2) Catalog: APT (2) Crypto: Blockchain Explorer (2) Malware Families (2) Catalog: CERTINT (2) Catalog: Logistics (2) Catalog: Operational Security (2) Ransomware Actors (2) Threat Actors (2) Catalog: Mining & Resource Crime (2) Crypto Sanctions (2) Disinformation (2) Proxy/Anon (2) Catalog: Academic (2) Catalog: CORPINT (2) Court Cases (2) Governance (2) Corporate Registry (2) Maritime (2) Catalog: Reference (2) Dark Web (2) ATT&CK Actors (2) C2 Certificates (2) Crypto: Crypto Phishing (2) Nation State (2) Armed Conflict (2) Catalog: CRYPTINT (1) Catalog: Emerging Tech (1) Catalog: LEGINT (1) Catalog: NETINT (1) Catalog: RF/Space (1) Catalog: SOCMINT (1) FININT: Securities Regulator (1) Ransom Payments (1) Sharing (1) Catalog: ACADINT (1) Catalog: Counterfeiting (1) Catalog: DOMINT (1) Catalog: Human Trafficking (1) Catalog: MEDINT (1) Catalog: PATENTINT (1) Catalog: SANCINT (1) Catalog: Vehicle (1) FININT: Legal Entity (1) Human Trafficking (1) PEP Screening (1) Vuln Mapping (1) ATT&CK (1) Catalog: Dark Web (1) Catalog: EPIINT (1) Catalog: Risk (1) Catalog: SUPPLYINT (1) Corporate/Legal (1) Crypto: Crypto Fraud (1) Environmental (1) Geolocation (1) Mobile ATT&CK (1) Catalog: ACTORINT (1) Catalog: ELECTINT (1) Catalog: Insider Threat (1) Catalog: REFINT (1) Catalog: Social (1) Catalog: VULNINT (1) FININT: Sanctions/PEP (1) ICS ATT&CK (1) Malware IPs (1) Scanning (1) Aviation (1) Catalog: Domain (1) Catalog: GEOINT (1) Catalog: Maritime Piracy (1) Catalog: PASTINT (1) Catalog: RISKINT (1) Catalog: Threat Analysis (1) Crypto: Crypto Sanctions (1) FININT: Enforcement (1) Catalog: AVINT (1) Catalog: CYBINT (1) Catalog: Environmental Crime (1) Catalog: LOGINT (1) Catalog: NEWSINT (1) Catalog: RFINT (1) Catalog: SPACEINT (1) Crypto: Crypto Attribution (1) Wildlife Crime (1) Catalog: ACCTINT (1) Catalog: Criminal (1) Catalog: ECONINT (1) Catalog: Identity (1) Catalog: METOCINT (1) Catalog: SIGINT (1) Catalog: VEHINT (1) Crypto Fraud (1) Humanitarian (1) Catalog: DARKINT (1) Catalog: Forced Labour (1) Catalog: MALINT (1) Catalog: OSINT (1) Catalog: TECHINT (1) Counterterrorism (1) FININT: Adverse Media (1) Refugee/Migration (1) Threat Reports (1)

Add more via Seed Sources.

🗃 Data Dictionary (84 tables)

TableApprox rows
activity_log109
alerts400
alert_rules17
api_keys0
asn_contacts105
asn_intel0
attack_groups176
attack_software825
attack_techniques697
attribution_map2.7M
campaigns29
campaign_indicators0
cases430
case_entities990
case_evidence932
case_indicators458
case_notes0
class_rules14
countries0
country_actor0
country_case0
country_corridor0
country_gap0
country_legal0
country_metric0
country_org0
country_source0
country_unit0
crypto_attribution18
cve_intel1.6K
detection_rules0
dns_records16.8K
domain_spec33
enrichments156.9K
entity_link0
entity_links21.1K
evidence_log0
feed_registry661
human_security565
humint_sources32
indicators1.1M
indicator_sources2.1M
indicator_tags3.2M
ingest_queue1
intel_disciplines0
ioc_rollup0
ip_dataset_imports0
ip_intel0
ip_ranges0
job_runs2
kv_cache837
legal_requests0
mission_domains0
narratives64
netflow0
net_log834
passive_dns3.1K
platform_log22
playbook_runs0
ransomware_decryptors18
ransomware_groups20
ransomware_victims207
risk_history0
sanctions20
saved_searches35
sectors8
settings35
social_posts0
sources302
source_catalog247
source_health0
statistics0
stat_rollup0
tags54
takedown_requests0
taxii_collections0
tip_reports250
triage_state0
user_api_keys0
wanted50
watchlists5
watchlist_items5
website_tech0
whois_cache1.8K
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

⚡ AI Skills

All SkillsResolveEnrichCorrelateSummarize

🔍 Lookup & Enrich

EnrichmentsPivotLink Analysis

📚 Docs & Reports

DocumentationGenerate ReportAPIPlatforms Hub

💡 Recommendations

⚙ Automation

Operations Center

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook

🔗 Related Tools

Mission CommandAdvanced SearchOperations Center