Field notes from the IC team: product walkthroughs, threat-intel patterns, and the occasional war story from the operators building Intel Consortium.
ICDB ships with a query language built for threat graphs. In five lines you can find every indicator linked to APT29, walk the cluster out to related actors, and pin the whole subgraph to an investigation. Here is the five-minute tour.
Read postA fresh ICDB install is an empty graph. The pid4 consortium is the fastest way to fill it: public-tier indicators, partner-org BOLOs, and attribution-preserved insights flowing into your tenant from the moment a J3J operator hits Approve.
Read postSingle static binary. SQLite on disk. Postgres and Kubernetes when the team grows. The same ICDB runs on your laptop and your production cluster — the binary is a flag away, and moving your data is one command: icdb migrate-db.
Read postEverything the ICDB UI does is a REST call. Scope an API key, trade it for a Bearer JWT, and your SIEM, SOAR, or short Python script can query, ingest, and mutate the graph the same way your analysts do.
Read post