Use case
Incident and threat-context research
Correlate public indicators, reputation, infrastructure and source-qualified threat context around an investigation.
Likely evidence
- Infrastructure and reputation signals
- Source-qualified threat records
- Historical and archive context where configured
Graph relationships
- Indicator resolves to infrastructure
- Source reports reputation signal
- Artifact associated with observation
Expected outputs
- Timeline and relationship context
- Evidence-linked review findings
- JSON/CSV and graph export
Safety boundary
Evidence still needs judgment.
Reputation and association do not independently prove control, compromise or malicious intent.
This workflow is explanatory, not a scan profile or guarantee of discovery. Target compatibility, registry readiness, configuration, scope and budget determine the exact plan.
Start with a target
Turn this workflow into an explainable investigation.
Create an account to plan your first evidence-backed investigation, or talk to us about team and workflow requirements.