Collaborative threat intelligence platform. Share with trusted peers, signed and ledgered.
Intel Consortium is the graph-native threat intelligence platform built to enable managed indicator sharing with trusted partners.
ICQL
Query in ICQL
A purpose-built query language for traversing your threat graph. Pull indicators, follow signed relationships across consortium boundaries, find paths between actors and infrastructure.
# Auto-ingested ThreatFox IOCs that form a link to a known cluster
from hbi.source="threatfox" hbi.tags~="emotet" >+forms> cluster
# Find the connection between a Tor exit and a known actor
path from nbi.value="185.220.101.45" to cluster.name="APT29" depth <= 4
# Reach everything within 3 hops of an APT cluster
from cluster.name="APT29" depth <= 3Try it
Write a query
Press ⌘+K in the app to bring up this same popup. Below, the same editor, minus the real graph and live data. Type any of the queries from the section above and watch the autocomplete fill in node types, relations, and keywords.
⌘K
ICQL · scratch query
mock · no live data