Frequently Asked Questions

Anyone who needs to keep track of threat activity in a structured way, from a single analyst running the binary on a laptop to a mature intel team sharing with trusted industry peers. Consortium sharing is where it earns its name, but nothing about the graph, ICQL or enrichment requires a consortium to be useful.

There’s a well-known principle in software engineering: you don’t truly understand the problem until you’ve solved it three times. The first two iterations of all pid4 apps were written by hand. The third, where the design finally crystallized, was built with multiple models as development assistants. The architecture, data model, and domain expertise are entirely human-authored.

icdb is a single static binary compiled for Linux, macOS and Windows. No runtime, no interpreter, no system packages to install: download it, run it, and it brings its own embedded database and web UI.

Yes, you can create a superset of the base schema. This way you can benefit from shared indicators. You and your consortium members can also share a custom schema.

ICDB ships with connectors for several open feeds, including those published by abuse.ch, and you can enable them per source. More will follow based on demand.

The permission model is opt-in. By default TLP permissions are enforced. If you want more granular permissions you can enforce an ownership model. The creator or designated owners of a cluster must approve attribution and edits to their cluster.

A closed, mutually-trusted group. Instead of trading intel with peer organizations over email, Slack or WhatsApp, a consortium is purpose-built for data-driven sharing, with provenance, access control and TLP baked in.

Yes, end to end. Anything you share through a consortium is encrypted with X25519 ECDH plus AES-256-GCM before it leaves your instance, and signed with your organization’s Ed25519 key. The relay broker that moves it between members only ever handles ciphertext, so neither your peers’ infrastructure nor the platform operator can read what is in transit.

Yes. Local installs can communicate with the IC broker service, which enables secure communication between consortium members.

Local or hosted. It’s up to you. Test locally with a single binary, scale up with docker to fit your needs.

Yes. Running ICDB locally is free and always will be: download the binary, run it, and you have a working threat graph with an embedded database. No signup, no trial clock, no feature-gated demo mode.