Feed Triage
Classifies every new feed entry, extracts IOCs, decides if it's a real alert.
Runs on every new feed entry
27 live feeds
CAM-01The standing watch
The 24/7 watch
Somebody is always on shift.
Registrations, certificates, leak sites, stealer markets, feed entries — the contacts keep coming whether your team is awake or not. The agents sweep continuously, triage everything that pings, and queue only what deserves a human.
- Every contact lands with evidence attached — screenshot, source, score.
- Severity decides who gets paged and who reads it at stand-up.
- The 3 a.m. find is a drafted takedown by morning, pending your approval.
SIMULATED SWEEP · ALL SECTORS--:--:--UTC
acquiring contacts…
CAM-02The camera wall
CAM-03Chain of custody
Agents
Five agents. One queue. End to end.
Each agent owns a chunk of the SOC's day. They write into the same case fabric, so a takedown drafted on Tuesday shows up on Thursday's investigation timeline without anyone copy-pasting.
Investigation
Pivots from any alert through actor, asset, IOC, and prior cases — autonomously.
Runs on any alert worth a deeper look
Threat Hunter
Picks an active actor cluster and hunts gaps in your defensive posture weekly.
Weekly sweep · 'Run hunt now' anytime
Brand Defender
Catches typosquats and impersonations the moment they register, drafts takedown.
Daily sweeps · CT streaming opt-in
Case Copilot
Summarises every linked alert/finding, drafts the response timeline as you work.
One-click refresh on any case
Threat map
The whole world, on one pane.
CTP247 geolocates the indicators it ingests and layers them on a world map — honeypot attackers, botnet C2, ransomware victims, malware distribution, phishing, Tor exits, exploited CVEs. The live map runs inside the product, filtered against your stack; the globe here is an illustration of the layer system.
See the threat mapOperating rhythm
You read the log, not the manual.
CTP247's worker emits a single, dense, monospaced log. Every ingest, every triage decision, every IOC, every takedown — the SOC sees the same line your engineers see. No stitching across dashboards.
- Triage. AI classifies new entries against your stack and brand. Hits become alerts; misses cost you nothing.
- Investigation. On every alert, an agent pivots through actor → asset → IOC → prior cases — and writes its findings.
- Hunt. A weekly hypothesis-driven sweep against an active actor cluster, surfacing the gaps you can fix before Friday.
- Brand. Typosquats and impersonations caught at registration time. Drafts the takedown, asks before sending.
- Case. Every linked alert + finding folds into a timeline the agent keeps fresh as you work.
Deployment
Self-hosted. Your data, your perimeter.
CTP247 ships as a single Docker Compose stack — Postgres, Redis, MinIO, the worker, and the API — with the dashboard served alongside by start.sh. Drop it in your VPC, point it at your feeds, run a triage.
Yours, not ours
No telemetry. No phone-home. Outbound traffic is the feeds you enable plus the LLM call — and you can swap to a self-hosted model with one env var.
Postgres-native
Indicators, alerts, cases, agent traces — all in one Postgres. Inspect with psql. Back up with pg_dump. No magic black boxes.
LLM agnostic
Ollama fully local, Anthropic, or any OpenAI-compatible endpoint. The agents speak prompt, you choose the model. Cost lands on your bill, not ours.
CyberThreatProtection247
The watch never ends.
Spin up CTP247 in your environment. Connect a feed. Run a triage. See what a watchfloor that never sleeps does for the team that has to.