Threat intelligence and the knowledge base

Threat Intel has two tabs. IOC Search lists the indicators your platform knows — addresses, domains, URLs, hashes — with their reputation, confidence and source. Knowledge Base is the reference shelf beside it: what the platform knows about malware families and threat groups, the vulnerabilities your scanners reported, your brand watch, your own intelligence, saved hunts and the public feeds.

Everything on this page is read from your own server. Only the public feeds and the brand checks use the network, and only as described under What needs the network.

The state of the shelf

The strip at the top says whether the reference is loaded (Offline — Active) and counts what is in it: indicators in the IOC database, malware families, APT profiles and CVE findings. Click a count to open its section.

Offline IOC Lookup

Type at least three characters — an IP address, a domain, a URL, a file hash, or the name of a malware family or a group — and press Search. The lookup checks, in this order:

Where	How it matches
Your organisation’s IOCs	The exact value
Indicators from the shared public feeds	The exact value
Malware families	The hash against each family’s known hashes; the name against names and aliases
APT profiles	The name against group names and aliases

The answer is either Nothing found — clean or one card per match with its grade, the family or group it belongs to, the confidence, and the MITRE ATT&CK techniques where they are known. The line under the verdict names the databases searched. Nothing is sent anywhere.

Note

“Clean” means none of these lists knows the value. It does not prove the value is safe.

The sections

Section	What it holds	Where it comes from
Malware DNA	Malware families: category, severity, aliases, MITRE techniques, target sectors, known hashes and C2 patterns	The reference bundle shipped with the platform
APT Profiles	Threat groups: origin, aliases, known tools, MITRE techniques, target sectors and how sure the attribution is	The same bundle
CVE Findings	Vulnerabilities found on your systems, with the affected assets and a risk score	Findings tagged as vulnerabilities, sent by a vulnerability scanner to POST /api/soc/vulnerabilities/ingest
Brand & Email	Look-alike domains registered against the domains you watch, and the SPF/DMARC posture of your own domains	Brand watch (below)
Local Intel	Your organisation’s own indicators, detection rules and file signatures, and the intel bundles imported	Added by your administrators, or imported from a bundle or a Sigma rule
Threat Hunting	Hunts over your own events and findings, started from a template, and the hunts you saved	Your data; no AI model is used
Feed Status	Each public feed: whether it runs, when it last synced and how many indicators it brought	The feed sync (below)

A family or group card opens into its full record. A shared reference entry is the same for every organisation; your own entries are yours alone.

Who can do what

Each role can also do everything the roles below it can.

Action	Role
See the state strip, feed status, brand hits, local intel and saved hunts	VIEWER
Read malware families, APT profiles and CVE findings; use the lookup	ANALYST
Refresh feeds now; run and save a hunt; scan a watched domain now	ANALYST
Reload bundle — apply the reference bundle again	ADMIN
Add, import or delete local IOCs, rules and signatures; export them	ADMIN
Upload local feed file — a text file, one indicator per line, into your organisation’s IOC database	ADMIN
Add or remove a watched domain	ADMIN

What needs the network

Feature	Uses the network when
URLhaus, Feodo Tracker, Tor exit list	An administrator has allowed outbound lookups (LEGIT_ALLOW_OUTBOUND_INTEL=true). Never in the air-gap kit
AbuseIPDB	An AbuseIPDB key is set. Never in the air-gap kit
Brand watch: look-alike DNS checks, registration (RDAP) and certificate lookups	A domain is being watched. Never in the air-gap kit
Everything else on this page	Never

Feed Status says why a feed is not running: Outbound lookups off, or No API key configured for a feed that needs one. Feeds that may run sync every 6 hours; Refresh feeds now syncs them at once. Indicators from a feed carry a 30-day expiry.

Watched domains are checked every 12 hours. A registered look-alike becomes a finding in the alert queue.

In the air-gap kit

The reference bundle is part of the kit and loads by itself. An offline update can carry a newer bundle; Reload bundle applies it at once instead of waiting for the next read. To add indicators without the internet, import an intel bundle or a Sigma rule in Local Intel, or upload a local feed file.

Limits

• The reference bundle is a curated set of well-known families and groups, not a complete catalogue. Its descriptions are in English.
• CVE Findings is empty until a vulnerability scanner reports what it found.
• An indicator matches only as its exact value (a family or group name can match in part); the lookup does not search inside URLs or match address ranges.