Download. Run. Done.

Four steps to your first graph

1. Download the binary for your platform
   Pick the build above. The archive contains a single static binary: no runtime dependencies, no installer.
2. Extract and run
   tar xJf icdb-*.tar.xz && ./icdb serve --admin-email=you@example.com starts a single-user instance on http://localhost:8181 with on-disk SQLite (ic.db in the working directory) so your data survives restarts. No database server, no broker, just one flag.
3. Sign in
   First boot prints an ICDB ready — first boot banner with an Email and a Password row. Sign in at http://localhost:8181 with the email you passed to --admin-email (not a username) and the generated password. Copy it before the log scrolls — it is shown once. Pass -p <yours> if you’d rather pick the password yourself, or run ./icdb reset-admin --admin-email you@example.com later to generate a new one.
4. Create your first threat graph
   Open the Threat Graph page in the UI (http://localhost:8181/threat-graph/) to spin up your first graph. This is where you’ll model adversaries, infrastructure, and the relationships between them, and where every later workflow (ingest, ICQL queries, dashboards) anchors.
5. Bonus: Explore consortiums
   Visit Settings → Consortium to browse public groups. The open pid4 consortium is free to join and is a good first taste of shared threat intel. If a peer has already sent you a private invite token, redeem it on the same page. Everything you share through any consortium is end-to-end encrypted and signed for third-party-verifiable attribution.