User Guide

ThreatWatch is a self-hosted cyber threat intelligence (CTI) platform: a STIX 2.1-native data model, a TAXII 2.1 server, dozens of threat-feed integrations, YARA scanning, a correlation engine, relationship graphing, and case/incident management, with optional Claude-based AI enrichment. This guide covers how to use the application day to day.

Signing in and accounts

• Sign in at /login. New installs can self-register at /register unless the operator has disabled public registration, in which case an admin provisions your account.
• Email verification is required for most of the app.
• Two-factor authentication can be turned on under Settings → Security.
• An admin can disable an account without deleting it.

Finding your way around

The sidebar is organized around the CTI workflow: reference intelligence (threat actors, malware, campaigns, indicators, vulnerabilities) at the top, analysis tools (graph, detection, file analysis) in the middle, and your team's own work product (reports, incidents, cases, threat hunts) below that. Most list screens support filtering, sorting, and pagination.

TLP and what you can see

ThreatWatch tags sensitive records with a TLP (Traffic-Light Protocol, version 2.0) label — CLEAR, GREEN, AMBER, AMBER+STRICT, or RED, least to most restricted — plus a confidence score. Anonymous visitors only ever see TLP:CLEAR/unlabelled records. Signed-in users see intelligence up to their own TLP clearance, set per-user by an admin. Treat a record's TLP marking as governing how you may share what you learn from it, independent of what the UI happens to let you view.

Dashboards

• Overview (/dashboard) — recent indicators, active campaigns, feed health, quick stats.
• Executive — high-level trend and risk summaries for leadership.
• Triage — a queue-style view for SOC analysts, with a wallboard variant for a shared display.
• Hunter — hypotheses, hunts in progress, and hunt-relevant intel.

Global search

Resolves a query — an IP, domain, hash, CVE ID, actor name, keyword — against every indexed record type at once and links straight to the matching record. The fastest way to answer "have we seen this before?" during triage.

The threat intelligence library

Core reference objects modeled on the STIX 2.1 spec, each with a list page and a detail page: Threat Actors, Malware, Campaigns, Intrusion Sets, Vulnerabilities, Attack Patterns, Tools, and the browse-only ATT&CK reference data Mitigations and Data Sources. Threat Actor Research holds collected open-source research notes attached to a specific actor.

Indicators

/indicators is the searchable library of atomic observables — IPs, domains, file hashes, URLs, email addresses — expressed as STIX indicator patterns, each with a type, TLP label, and confidence score. Admins can create records one at a time or in bulk, and generate detection-rule output from qualifying indicators.

Relationship graph and analysis tools

• Relationship Graph — an interactive, force-directed graph of how actors, malware, campaigns, tools, and indicators connect.
• Kill Chain Analysis — maps an actor's or campaign's known techniques onto a kill-chain/ATT&CK-tactic view.
• Threat Model Builder — an authoring tool for building a threat model from the reference library.

Detection

Detection Strategies is a browse-only library per ATT&CK technique. The Detection Coverage Heatmap shows, per technique, how many detections/rules exist — use it to spot coverage gaps. Correlations shows results from the background correlation engine, which links related intelligence objects together automatically.

File analysis (YARA)

/yara-scanner combines a Scanner (upload a file to run it against the loaded rule set — nothing is persisted server-side), a Library of loaded rules by category, and a Tester for trying your own rule before adding it. YARA Community is a separate, shared library of rules and scan results contributed across the platform.

Reports and analyses

/reports is where finished intelligence write-ups live, with STIX/TAXII export support. AI-generated or analyst-authored deep dives are listed under the Reports page's Analyses tab.

Team workflow

Your organization's own work product — created and edited by anyone who can manage org content: Incidents (timeline, severity, status, collaborative confidence-rating), Cases (broader investigations linking tasks and notes), Priority Intelligence Requirements, and Threat Hunts.

Watchlists

Admin-managed reference content: Narratives (tracked disinformation/influence narratives), Channels (the media/social channels a narrative propagates through), and Observed Data (raw sightings tied back to STIX observables).

News

/news is a curated threat-intel news feed, readable by guests and signed-in users alike.

AI enrichment

Where an administrator has configured an AI provider, detail pages for threat actors, malware, and campaigns show an "Analyse with AI" action that generates a structured write-up saved back to the record as a Threat Analysis. Configure your own preferences under Settings → AI Analysis.

Getting data out

The SIEM Feed page has read-only instructions for pointing an external SIEM/SOAR at this platform's TAXII 2.1 endpoint (/taxii/), reachable with a session or a personal API token. Admins can also download a Hunt Package bundling a threat actor, campaign, or malware record's intelligence for a hunt engagement.

Your settings

Reachable from the profile menu: Profile, Appearance, API Tokens (personal access tokens for scripting or TAXII access — treat them like passwords), Organization, Notifications, AI Analysis, and Security (password and two-factor authentication).

Administration

Everything under Admin requires the platform-admin role: Users (accounts, TLP clearance, enable/disable), Login Logs, Integrations (the threat-feed catalog and sync scheduling), Correlation Schedule, Mail Settings, Research Requests, and Takedown Requests.

Roles and permissions

ThreatWatch layers two independent role systems. A platform admin manages the shared, ingested threat-intel pool, integrations, and everything under Admin, independent of organization role. Your organization role (viewer → member → admin → owner) controls whether you can create/edit your organization's own work product — cases, incidents, PIRs, threat hunts, reports — but never grants write access to the platform's shared intelligence library. Your TLP clearance, set per-user by a platform admin, independently gates what you can read. If a screen or action you expect to see is missing, ask your platform admin to check your account under Admin → Users.