← index
security / cti · 2026 · completed

threats

Cyber threat intelligence platform — 175K+ CVE library, IOC feeds, MISP/STIX integration, and adversary tracking for security teams. Live and customer-ready.

★ 0rce Ecosystem
ctithreat intelligenceioccvemispstixenterprise

About

threats is a cyber threat intelligence (CTI) platform that aggregates, enriches, and visualizes adversary infrastructure, vulnerabilities, and attack patterns. It serves as the central intelligence hub for security teams, enabling proactive threat detection, incident response, and adversary tracking.

Know your enemy — before they know you.

What It Does

  • CVE Library: 175,000+ vulnerabilities (NVD, OSV.dev, GitHub Advisory Database) with EPSS scores, CVSS vectors, and exploitability tags. Stay ahead of emerging threats with real-time updates and historical context.
  • IOC Feeds: 250,000+ indicators of compromise (IPs, domains, hashes) from open-source feeds (Phishing.Army, OpenPhish, Abuse.ch) and proprietary sources. Detect and block adversary infrastructure before it reaches your network.
  • Adversary Tracking: Actor profiles (APT groups, ransomware gangs, hacktivists) with aliases, motivations, and observed TTPs (MITRE ATT&CK mapping). Track adversary campaigns and predict their next moves.
  • MISP/STIX Integration: Import/export events in STIX 2.1 and MISP JSON format. Push/pull from MISP instances via API. Share intelligence with trusted partners and communities.
  • Graph Visualization: Force-directed graph of CVEs, IOCs, actors, and techniques (D3.js). Identify hidden connections and attack patterns with interactive exploration.
  • Search & Alerts: Full-text search (PostgreSQL FTS5) with saved queries and email/webhook alerts. Get notified when new threats match your criteria.
  • API: RESTful endpoints for CVE lookup, IOC enrichment, and actor search (OpenAPI 3.1 schema). Integrate threats into your SIEM, SOAR, or custom tools.

Who It’s For

  • Security Operations Centers (SOC): Enrich alerts with threat intelligence. Prioritize incidents based on adversary activity and exploitability.
  • Threat Intelligence Teams: Track adversary campaigns, map TTPs to MITRE ATT&CK, and share intelligence with partners.
  • Incident Responders: Investigate breaches with historical context. Identify adversary infrastructure and predict lateral movement.
  • Vulnerability Management Teams: Prioritize patching based on EPSS scores and adversary activity. Focus on vulnerabilities that matter most.
  • Red Teams & Penetration Testers: Research adversary TTPs and infrastructure. Use intelligence to simulate real-world attacks.
  • Compliance & Risk Teams: Generate reports for compliance frameworks (ISO 27001, NIST CSF, MITRE ATT&CK). Demonstrate proactive threat intelligence capabilities.

Built With

  • Frontend: Next.js 14 (App Router) + Tailwind CSS 4
  • Backend: Next.js API Routes + PostgreSQL 16 (TimescaleDB extension)
  • Cache: Redis 7 (cache, pub/sub, rate limiting)
  • Search: PostgreSQL FTS5 (full-text) + trigram indexes (fuzzy matching)
  • Task Queue: BullMQ (Redis-backed) for data ingestion and enrichment
  • Deployment: Docker + Cloudflare Tunnel (Oracle ARM)

Key Features

Real-Time Threat Intelligence

Aggregate and enrich data from 7+ sources (NVD, OSV.dev, GitHub Advisory Database, Phishing.Army, OpenPhish, Abuse.ch, AlienVault OTX). Update feeds every 6 hours with incremental backfill for historical context.

Adversary Tracking

Track 1,200+ adversary groups (APT, ransomware, hacktivists) with aliases, motivations, and observed TTPs. Map TTPs to MITRE ATT&CK for standardized reporting.

Graph Visualization

Explore hidden connections between CVEs, IOCs, actors, and techniques. Use interactive filters to focus on specific adversaries, campaigns, or timeframes.

MISP/STIX Integration

Import/export events in STIX 2.1 and MISP JSON format. Push/pull from MISP instances via API. Share intelligence with trusted partners and communities.

Custom Alerts

Create saved queries for specific threats, adversaries, or IOCs. Get notified via email or webhook when new matches are found.

API-First Design

RESTful API with OpenAPI 3.1 schema (Swagger UI at /api/schema/). Integrate threats into your SIEM, SOAR, or custom tools. Automate threat intelligence workflows.

Data & Intelligence

CVE Library

  • Sources: NVD, OSV.dev, GitHub Advisory Database
  • Coverage: 175,000+ vulnerabilities (2010–present)
  • Enrichment: EPSS scores, CVSS vectors, exploitability tags, references, CWE mapping
  • Updates: Real-time (NVD API) + incremental backfill (OSV.dev, GitHub)

IOC Feeds

  • Sources: Phishing.Army, OpenPhish, Abuse.ch (SSL Blacklist, Feodo Tracker), AlienVault OTX pulses
  • Coverage: 250,000+ IOCs (IPs: 124,887, domains: 89,421, hashes: 36,004)
  • Enrichment: WHOIS (RDAP), VirusTotal API, geolocation, ASN mapping
  • Updates: Every 6 hours + incremental backfill (2010–present)

Adversary Tracking

  • Sources: MITRE ATT&CK, AlienVault OTX, Mandiant APT reports (parsed PDFs)
  • Coverage: 1,245+ adversary groups (APT, ransomware, hacktivists)
  • Enrichment: Aliases, motivations, observed TTPs, campaigns, targets
  • Updates: Weekly + manual curation

Graph Intelligence

  • Nodes: CVEs, IOCs, actors, techniques, campaigns
  • Edges: CVE→IOC (exploited by), IOC→actor (used by), actor→technique (uses), technique→campaign (part of)
  • Coverage: 3,925+ edges (2026-09-10)
  • Visualization: Force-directed graph (D3.js) with interactive filters

Security & Compliance

  • Rate Limiting: Upstash Redis for API rate limiting (100 requests/minute per IP).
  • CORS: Restricted to *.0rce.com and localhost origins.
  • CSRF: Next.js CSRF protection (SameSite=Lax cookies).
  • Data Validation: Zod schemas for all API inputs.
  • Sensitive Data: API keys and credentials stored in environment variables (12-factor app).
  • Data Encryption: All data encrypted at rest (PostgreSQL TDE) and in transit (TLS 1.3).

Development Status

  • Current Phase: Live and customer-ready at threats.0rce.com
  • Data Stats (as of 2026-09-10):
    • CVEs: 175,206
    • IOCs: 250,312 (IPs: 124,887, domains: 89,421, hashes: 36,004)
    • Actors: 1,245 (APT groups, ransomware gangs, hacktivists)
    • Techniques: 392 (MITRE ATT&CK mapping)
    • Graph edges: 3,925 (CVE→IOC, IOC→actor, actor→technique)
  • Next Milestones:
    • AI-powered threat summaries (LLM integration)
    • Custom feed builder (user-defined IOC sources)
    • MISP instance federation (multi-instance sync)
    • Mobile app (React Native)