DARK THREAT RADAR CTI ENGINE
GitHub ↗

OPEN-SOURCE // AUTONOMOUS CTI

Turn public threat data into operational intelligence.

Dark Threat Radar continuously collects, normalizes and correlates vulnerabilities, malicious infrastructure, ransomware exposure and security advisories — in one analyst-ready workspace.

Deploy with Docker Explore the platform
27PUBLIC CONNECTORS
5mCORE INGESTION
MITOPEN SOURCE
LIVE INTELLIGENCE WORKSPACE
Dark Threat Radar dashboard showing global internet activity and threat intelligence telemetry
INGESTION ACTIVE
2+ SOURCE CORRELATION
VULNERABILITIESIOC CORRELATIONMALWARERANSOMWAREATT&CKADVISORIES

01 // THE PLATFORM

Built for signal, not noise.

Every layer is designed to reduce context switching: provider-aware collection, normalized data, correlation and a single interface for investigation.

01

Multi-source correlation

Normalize and deduplicate indicators while preserving every contributing provider and confidence signal.

  • IPs, URLs, domains and hashes
  • Provider provenance
  • Lifecycle and confidence
02

Exposure intelligence

Track extortion disclosures and data breaches across independent public sources, not only ransomware labels.

03

Official remediation

Connect CVEs, CISA KEV, EPSS and vendor advisories to the technologies your team actually operates.

CRITICALKEVEPSS
04

Operational visibility

See connector health, synchronization state, source errors and collection paths without leaving the dashboard.

02 // INTELLIGENCE LIFECYCLE

From collection to analyst action.

Dark Threat Radar implements the essential CTI lifecycle as a continuous, observable pipeline.

01CollectPublic feeds and authenticated community sources
02NormalizeConsistent entities, timestamps and identifiers
03CorrelateIndependent observations become stronger evidence
04AnalyzeConfidence, severity and organizational relevance
05ActAlerts, investigation and remediation guidance

03 // LIVE SOURCE TOPOLOGY

Know exactly where your intelligence comes from.

HEALTHY NEEDS AUTH ERROR
CISA KEVNVD CVEEPSSRANSOMWARE.LIVERANSOMFEEDRANSOMLOOK
DTRCTI ENGINE
MITRE ATT&CKTHREATFOXURLHAUSMALWAREBAZAARALIENVAULT OTXMSRC

Animated source health makes ingestion observable. The platform currently integrates 27 public CTI connectors across vulnerability, malware, network, ransomware, news and threat-knowledge categories.

04 // PERSONALIZED INTELLIGENCE

Your organizations, domains and technology — watched continuously.

The Watchlist turns the global data stream into a focused workspace. Monitor customers, brands, domains, countries, vendors, products and specific CVEs.

01

One alert per incidentIndependent observations are correlated instead of duplicated.

02

Confidence through confirmationTwo or more sources strengthen the same finding.

03

Visual operational statusHoneycombs surface monitored, attention and critical states.

Dark Threat Radar Watchlist with honeycomb visualizationWATCHLIST // OPERATIONAL VIEW
Dark Threat Radar animated source health topologySOURCE HEALTH // 27 CONNECTORS

05 // SOURCE HEALTH

Collection you can inspect, not just trust.

Each connector reports its own condition, last synchronization and errors. The animated topology exposes the entire ingestion path directly on the dashboard.

VULNERABILITIESMALWARE & IOCSNETWORK INTELLIGENCERANSOMWARE & BREACHESPHISHINGTHREAT KNOWLEDGE

06 // SELF-HOSTED BY DESIGN

Own the engine. Own the data.

Run Dark Threat Radar on your infrastructure with Docker Compose or native Linux. Threat records and protected credentials stay under your control.

QUICKSTART
$ git clone https://github.com/fr3dux/dark-threat-radar.git $ cd dark-threat-radar $ python3 scripts/setup_admin.py $ docker compose up -d

DARK THREAT RADAR // CTI ENGINE

Build a clearer threat picture.

Start with the open-source edition, inspect the architecture and deploy it in your own environment.

View project on GitHubContact