Tags / Labels

🏷 Tags / Labels — tag intelligence

Inventory derived local-first from the indicator_tags graph (indexed GROUP BY tag_id) merged with the tags dictionary — used-but-unnamed tags surface as orphaned, defined-but-unused as unused. Populated even when every external feed is offline.

Distinct tags

14
14 named

Tag links

0
indicator↔tag edges

Tagged indicators

0
distinct IoCs

Taggable indicators

953.2K
in local store

Orphaned tag_ids

0
used, no tags row

Unused tags

14
defined, 0 links

⚡ Tag operations

Resolve / auto-tag →Tag feeds →Advanced search →Correlate →Analytics →Bulk takedown →

📈 Top tags by volume

No data.

Bars scale to the busiest tag. Click a label to drill into search.php?tag=.

🔗 Tag co-occurrence hints

No co-occurrence detected in the sampled edges (tags rarely share indicators, or only one tag has volume).

Computed from a bounded sample (≤5k indicators/tag) — directional hints, not exhaustive counts.

🏷 Create Tag

🏷 Bulk Apply Tag

📋 Tag Inventory (14)

TagIDDescriptionStatusIndicators
apt 1 unused 0 drill →
apt-linked 12 Attributed to a named threat actor unused 0 drill →
botnet 5 unused 0 drill →
c2 4 unused 0 drill →
cve-exploited 13 CVE selector / exploited vulnerability unused 0 drill →
malware 6 unused 0 drill →
nation-state 14 Actor maps to a nation-state sponsor unused 0 drill →
phishing 3 unused 0 drill →
proxy 9 unused 0 drill →
ransomware 2 unused 0 drill →
ransomware-linked 11 Family/actor matches a known ransomware family unused 0 drill →
scanner 7 unused 0 drill →
spam 10 unused 0 drill →
tor 8 unused 0 drill →

🔍 OSINT pivots — external references

MITRE ATT&CK →MISP taxonomies →MISP galaxies →STIX 2.1 labels →Malpedia →ThreatFox tags →

🔗 Internal pivots & actions

Resolve / auto-tag →Correlation graph →Advanced search →Analytics deck →Watchlist →Export STIX/MISP →
The inventory is built local-first: a single indexed GROUP BY tag_id over indicator_tags gives every used tag's exact link count, merged with the tags dictionary so orphaned tag_ids (used but never named) and unused tags both surface. Co-occurrence is sampled (bounded per tag) to stay fast on a multi-million-row graph. Nothing here depends on an external API.
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

⚡ AI Skills

All SkillsResolveEnrichCorrelateSummarize

🔍 Lookup & Enrich

EnrichmentsPivotLink Analysis

📚 Docs & Reports

DocumentationGenerate ReportAPIPlatforms Hub

💡 Recommendations

⚙ Automation

Operations Center

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook

🔗 Related Tools

Mission CommandAdvanced SearchOperations Center