Automation First

The vast majority of connections in an ICDB graph are created automatically. Indicators flow in from built-in OSINT feeds and your security stack. Detection results pushed in from your existing tools create edges. Consortium partners share indicators that land in your graph pre-linked.

The work that actually requires a human such as attribution, judgment calls, connecting the dots between campaigns is where your analysts spend their time. Not copying and pasting indicators between spreadsheets.

Inside a consortium, BOLOs (“be on the lookout”) match every incoming indicator against patterns your team registered. When a partner shares data that fits one of your standing patterns, you know immediately.