Correlate · Intelligence core
One graph. Scored from evidence, explained on request.
Twenty indicator types, seven relation types and eight threat types in a STIX 2.1-native model, and a scoring function that weighs what happened on your own sensors above any feed. A relationship graph you can read, a news wire that knows what you run, and AI that is optional: local, your own key, or off.
20 indicator types
Network, file and identity
- ip
- domain
- url
- hash
- cve
- cidr
- asn
- certificate
- crypto-wallet
- ja3
- ja4
- file-name
Fraud infrastructure
- iban
- bic
- card-bin
- phone-number
- sms-sender-id
- app-package
- social-handle
An IBAN is mod-97 checked; a card BIN is six to eight digits and nothing longer is accepted; a full card number is refused everywhere. Fraud types travel in JSON, STIX and MISP as context for a fraud team; MISP never marks them for IDS, and the nginx, Suricata and RPZ blocklist formats refuse them.
8 threat types
- c2
- phishing
- malware-delivery
- brute-force
- scanner
- spam
- vulnerability
- fraud
7 relation types
- resolves-to
- drops
- contacts
- hosted-on
- c2-hostname
- delivers
- related-to
The unique key is (type, value). A second source for the same value becomes a second row under the same indicator. That is what correlation is, and it is why confidence is a function of evidence rather than a number a vendor typed.
Scoring
Confidence and severity, recomputed from six kinds of evidence.
Source count and grade
Every source under an indicator is a row; the Admiralty grade of each weighs how much it moves confidence.
Recency and lifecycle
Per-threat-type aging: phishing decays fast, C2 slower. Expiry and retention run daily; a feed-freshness metric is the dead-man’s switch.
Relationships
A domain that resolves to a known C2, a URL that delivers a known hash: edges raise the score of what they touch.
First-party evidence
Sensor activity and edge sightings weigh more than any feed, because they happened to you.
Allowlist override
CIDR containment and wildcard e-mail patterns force Clean before anything downstream sees the indicator.
Analyst disposition
True/false positive marks feed a detection-quality analytics page: precision and calibration over time, per source.
STIX 2.1-native
Standards as the data model, not an export format.
SDOs
First-class objects
Campaign, intrusion set, threat actor, attack pattern, identity and marking definitions are tables, not JSON blobs.
SROs
Every observation declares its edge
Sensor drops and contacts, detonation edges, payload delivery, brand lookalikes: each writes a typed relation with a provenance string.
bundle import/export
Round-trips
Import a STIX 2.1 bundle through the same write path; export indicators, SDOs or whole bundles; serve them over TAXII 2.1 collections.
TLP
Markings enforced
TLP is checked on every dispatcher and export; a TLP:RED indicator never leaves in a feed or a webhook.
The relationship graph
A hub with four hundred URLs is one row until you open it.
tree
A collapsible tree, rooted at the indicator
Neighbours are grouped by relation and direction and read as a sentence: “hosts · 412 URLs”, “resolves to · 3 IPs”. A hub stays one row until you open it, then fifty members at a time, sorted by severity. A group states its true size before anything loads.
graph
A layered DAG as the second view
The same neighbourhood drawn left to right in stored edge direction, with a hub’s leaf neighbours folded into one group box. View, open rows and depth live in the URL, so a view is a link.
f
Full screen on demand
One key makes the graph the whole screen, with rows and boxes sized to be read from across the room. Esc returns it. Keyboard navigation throughout.
ATT&CK
MITRE ATT&CK in the graph
ATT&CK Enterprise is ingested as attack-pattern, intrusion-set and malware objects, so techniques are nodes in the same model as the indicators, sessions and actors they describe.
Security wire
The news that mentions what you run, flagged as such.
Advisories and reports from CISA, NCSC UK (news and threat reports), SANS ISC and Microsoft MSRC, in one wire. CVEs are extracted from each item and flagged “affects you” when they match a known-exploited indicator you hold, an open patch finding, or a sensor persona you run. The wire is context only: a news item never becomes an indicator.
Exploitation of an SSL-VPN appliance vulnerability observed in the wild
CVE-2025-0282affects you
- › matches a known-exploited indicator in your graph
- › you run the Ivanti Connect Secure persona on 2 sensors
AI
Chosen at install. Local, your own key, or off.
AI is chosen at install: a local model (any OpenAI-compatible server: vLLM, Ollama, llama.cpp), Anthropic with your own key, or off. The stock configuration refuses to start on a hosted provider without a key, so nothing reaches an AI provider you did not configure. With AI off, everything except AI summaries and classification works; Ask returns retrieval-only answers with citations.
Visual screenshot comparison of lookalike pages needs the hosted provider. The triage model’s state and AI evaluation runs live in the tenant’s own database, so they survive restarts and never leave it.
How the switch is configuredModule
AI Threat Analysis
- › Indicator summaries with MITRE ATT&CK mapping
- › Classification of sensor sessions, phishing kits and the impersonated brand
- › Reading lookalike pages and proposing a disposition with reasons, never closing one alone
- › Novelty review of request shapes the fleet has not seen before
Module
Advanced AI Intelligence
- › Ask your intel: retrieval on PostgreSQL full-text search, with citations; no external vector database
- › The explainable triage model that learns from your team’s decisions
- › Threat-actor profiling and campaign clustering
- › Attribution and targeting reports
- › The exclusive-intelligence ledger report: what your sensors saw first
The two AI modules come with packages rather than on their own: AI Threat Analysis in Advanced and Complete, Advanced AI Intelligence in Complete. Packages and modules.
Explainable ML · Advanced AI Intelligence
A triage model trained on your own decisions, that shows its work.
Part of the Advanced AI Intelligence module. A classical model that runs on CPU ranks per-feature contributions on every prediction and learns from your analysts’ true- and false-positive marks. The training corpus is governed: exclusion reasons, sanitised export, a stats panel. Model state lives in your tenant’s database; no model leaves your deployment.
- honeypot_sessions_7d+0.34
- source_grade_weighted+0.22
- asn_reputation+0.17
- recency_hours+0.12
- relation_to_known_c2+0.08
Ask your intel
Grounded answers with citations, on PostgreSQL, not a hosted embedding service.
Retrieval runs on PostgreSQL full-text search over your own indicators, cases, sessions and reports. The answer cites what it used; every citation is a link. With AI off it returns retrieval-only answers with citations, which is still a useful search.
› what hit client-07’s fortigate persona this week that nobody else reported?
Two sources: 203.0.113.47 (FortiOS CLI, 14 sessions, first seen on your sensors before any external feed carried it) and a credential-stuffing run from AS64500 against the FortiGate clone. Neither appears in an external source; both are in the first-party ledger as new to the platform.
indicator #18422session cluster c-91ledger run 2026-09-14
# provider: local · 3 citations · illustrative
Working the graph
Search, hunt, save, act.
Search
ILIKE and trigram search across values and context; filters, sort and peek state live in the URL so a view is a link.
Saved queries as hunts
Any query can run on a schedule and notify on new hits: a hunt that keeps running after the analyst goes home.
Saved views and bulk actions
Named views per analyst, multi-select with tag / disposition / add-to-case / export in one step.
Actors and campaigns
Analyst-curated actor records, AI-profiled on request where the module is licensed, and behavioural clusters of sensor sessions promoted to campaigns.
Navigation and ⌘K
Nine sections organised by what the analyst came to do, an inbox of what changed since you last looked, and a command palette that reaches every page and every entity.
Import and export
CSV/JSON in and out, STIX bundles, and a bulk lane for volume feeds with deferred correlation.
Bring a bundle and a question.
Import a STIX bundle you already have, ask the question you could not answer last week, and watch what the graph does with both.