ThreatCluster

About ThreatCluster

ThreatCluster ingests more than 20,000 threat intelligence sources and clusters them into a single deduplicated live feed, so an analyst reads one item per incident instead of forty near-identical articles. The feed is personalised to tracked interests rather than global: an operator adds the vendors, technologies or actors they care about and the clustering runs against that set, with trending and popular views alongside a personal feed. Each cluster expands into full incident timelines, attack flows mapped step by step to MITRE ATT&CK, interactive STIX relationship graphs, and defensive countermeasures mapped to D3FEND, which is the part that separates it from a news aggregator. Output is built for use elsewhere: public RSS and MISP feeds, bulk IOC export, ready-made hunting queries in KQL, SPL and Lucene, ATT&CK Navigator export, and a REST API with a companion `tc` CLI. Alerting runs through personalised digests, webhooks and alert rules keyed to unlimited keywords on paid tiers. Higher tiers add dark web access, ransomware leak-site tracking, credential exposure monitoring and X/Twitter intelligence. The free tier is unusually load-bearing for this category — a personalised, clustered, real-time feed with a 100-request-per-day read-only API and no card required, ever — with the paid tiers gating read volume, saved feeds, alerting and the dark web sources rather than the core feed itself.

Key Features

Tags