Actor Tracking & Notebooks
Auto-built profiles for the adversaries that matter, seeded from the MITRE ATT&CK group catalog and refreshed continuously.
Learn more19 sensors. IT to grid.
Nineteen protocol sensors, from SSH to the substation.
Plus actor tracking, dark-web agents and private AI, in one console built for analysts who have to defend their conclusions.
console.threatspire.com / ctiledger
Built natively on the MITRE ATT&CK® framework
180+ tracked adversary groupsEvery claim source-linkedEvidence-first by designMulti-tenant & SSO-ready
The problem
Threat intel shouldn't die in a PDF.
Reports are scattered across vendors and channels. Claims are made without sources. Findings rarely reach the people who decide what to hunt, block, or escalate — and by the time they do, the next campaign is already moving.
"Threatspire has saved me over 60% in time researching threats to our organization"
Carl Doss, CTO — The Joselyn Foundation
The platform
A console for analysts, not a dumping ground for feeds.
AI Threat Actor Reports
One-click, CTID-style Threat Actor Profile Reports — executive summary, confidence-rated assessments, MITRE TTP tables, and evidence with clickable sources, drafted by AI and grounded in citations.
Targeted-Industry & TTP Analytics
Charts that show who an actor is hitting and how — industries derived by AI from the evidence itself, techniques sourced from MITRE ATT&CK group data.
Intelligence Requirements
Turn your org's standing questions into tracked, signal-driven RFIs. The Requirement Agent drafts judgments and recommended actions for analyst review.
Learn morePer-User Workspaces & Sharing
Every analyst gets their own workspace. Share requirements, cases, and IOCs at view, comment, or edit level — with comment threads and a full admin audit log.
Honeypot Sensor Fleet
Nineteen protocol sensors from IT to the plant floor: SSH, Telnet, HTTP/HTTPS, RDP, SMB, SIP/VoIP, MySQL, MSSQL, Redis, LDAPv3/AD, DNP3, Modbus/TCP, IEC 60870-5-104, IEC 61850 MMS, PROFINET, BACnet/IP, OPC-UA, Siemens S7 (S7comm), and generic TCP/UDP.
IOC & Case Management
Validate, enrich, and manage indicator lifecycle. Investigations become shareable cases with Diamond Model analysis.
Learn moreSecure Multi-Tenant
Each customer runs in its own dedicated instance with its own database. Mandatory MFA, single sign-on via OpenID Connect, argon2id password hashing, authenticator secrets encrypted at rest, and a web application firewall in front of every request.
Agentic Dark Web Monitoring
AI agents sweep dark web markets, forums, and leak sites around the clock for your leaked credentials, exposed intellectual property, and brand mentions, then triage every hit for analyst review.
Investigation Ledger
Track every assessment in one ledger. The AI drafts an assessment for each intelligence requirement, grounded in your evidence and CISA KEV; analysts edit and sign off.
Real-time alerts
Rules-based alerts on new actor activity, honeypot hits and dark-web leaks, delivered to Slack, Microsoft Teams, email or any webhook.
Threat Actor Landscape
See the whole adversary landscape at a glance.
One screen for every group you track and every group you should.
- KPI cards with 30-day change
- Map of targeted countries
- Activity over time, by actor
- One-click actor drawer: summary, recent activity, TTPs, and Track/Untrack
Asset-aware prioritization
Intelligence ranked by what you run.
Import your asset inventory and ThreatSpire puts the threats that touch your stack first.
- Import assets from CSV, ServiceNow, Tenable, Rapid7 or Qualys
- CVEs matched to the exact versions you run, using NVD affected ranges
- CISA Known Exploited Vulnerabilities flagged automatically
- A daily "What Matters to You" briefing
New · Announcing
Agentic dark web monitoring, working while you sleep.
ThreatSpire now deploys AI agents that sweep dark web markets, forums, paste sites, stealer-log channels, and ransomware leak sites around the clock. Every hit is triaged, correlated to your organization, and routed into the console with evidence and recommended next actions. No feeds to tune, no queries to write. The agents do the digging; your analysts make the call.
- Continuous agent sweeps, not daily digest feeds
- Every finding source-linked and confidence-rated
- Confirmed exposures escalate straight into your requirements and cases
Included in ThreatSpire platform plans
The Dark Web Agent fleet
Specialized agents each run their own collection plan, then hand off verified findings the same way a junior analyst would. You review the evidence, not the raw chatter.
Leaked credentials
Combolists, stealer logs, and breach dumps tied to your domains, screened and validated before they reach you.
Intellectual property
Source code, schematics, and internal documents offered for sale or posted to leak sites and paste dumps.
Brand & executive impersonation
Lookalike domains, fake support channels, and fraudulent social profiles impersonating your people.
Ransomware & actor chatter
Leak-site listings and forum chatter naming your organization, mapped to the actors behind it.
Deep Search
Ask a question; AI agents explore .onion sites, leak sites and Telegram channels and return a readable report that leads with key findings.
Watchlists that never sleep
Watch your domains, email addresses, names, phone numbers and file hashes. Get alerted when they appear in leaks, ransomware leak-site claims or breach data from Have I Been Pwned.
New · Announcing
Introducing Hospital Honeypot — deception for healthcare's most attacked devices.
Eight fully-simulated clinical devices. Real protocols. Zero real patient data. Every captured attack flows straight into your ThreatSpire threat intelligence pipeline — built on ThreatSpire, not bolted onto it.
Why it matters
Healthcare is the most targeted critical-infrastructure sector on the internet — and the devices attackers go after aren't laptops, they're the ones keeping patients alive. Dialysis machines, infusion pumps, anesthesia systems, and medication cabinets increasingly run on the same networks as everything else, often with decades-old protocols and little to no authentication. Most security teams have no way to see an attack against one of these devices coming until it's already happened.
Hospital Honeypot puts a decoy in front of the attacker instead — and feeds everything it captures directly into ThreatSpire, so it becomes part of your actual threat picture, not an isolated log file nobody checks.
Eight real device types, faithfully simulated
Kidney dialysis machine, MRI scanner, bedside cardiac monitor, medication dispensing cabinet, point-of-care analyzer, infusion pump, anesthesia machine, and nurse call system — covering diagnostics, life support, medication management, and clinical communications.
Real protocols, not toy emulation
DICOM for the MRI sensor, HL7 v2 over MLLP for the cardiac monitor, a POCT1-A2-inspired protocol for the point-of-care analyzer, an IEEE 11073 SDC-inspired protocol for anesthesia — attackers interacting with these sensors see the same protocol behavior they'd see on a real device, down to vendor-specific personas and realistic drifting vitals.
MITRE ATT&CK for ICS, mapped automatically
Every captured interaction — a status query, a brute-forced login, a parameter write, a connection scan — is automatically classified against MITRE ATT&CK for ICS, so what you get isn't raw logs, it's structured, analyst-ready signal.
Native ThreatSpire integration, required and built-in
Hospital Honeypot is a ThreatSpire product — it requires an active ThreatSpire subscription to run. Every event is pushed directly into your ThreatSpire tenant for actor attribution, IOC extraction, and alerting alongside the rest of your threat intel, with no separate console to check and no manual export step.
Zero real PHI, ever
Every patient name, session, and device identity is synthetically generated at runtime. Nothing real ever touches the codebase, the database, or an attacker's screen.
Deploy in minutes
Signed, notarized installers for macOS, plus .deb and .rpm packages for Linux. Install the binary, point it at your ThreatSpire tenant with your API token, and it's live.
Available to ThreatSpire customers.
Decoy personas
Your attacker doesn't see a honeypot. They see your vendor's equipment.
A generic ICS responder gives itself away the moment an attacker fingerprints it. Ask a real Modbus PLC who it is and it answers with a vendor and a model number. ThreatSpire's industrial sensors answer the same way — down to the identification objects operators actually query — so reconnaissance returns a plausible device instead of a tell.
Now included in every ThreatSpire plan: the full honeypot sensor fleet, IT and OT.
Deploy in minutes
- 1Create a deployment in the console.
- 2Copy its key and the setup lines shown on screen.
- 3Restart the sensor; it checks in and appears live.
Change sensors and decoy personas remotely; no inbound ports needed.
Switch vendors from the console
Pick the persona that matches the plant you're defending. Changes are applied to your on-prem honeypot within about 30 seconds — no redeploy, no site visit, no SSH session.
BACnet/IP
UDP 47808- Tridium JACE-8000(default)
- Siemens Desigo PXC
OPC-UA
TCP 4840- Kepware KEPServerEX(default)
- Siemens SIMATIC S7-1500
Vendor-accurate across the ICS fleet
The rest of the industrial sensors ship with fixed decoy identities modelled on equipment you'd actually find on a plant floor or in a substation.
- Modbus/TCPSchneider Electric Modicon M340
- IEC 61850 MMSSiemens SIPROTEC 5
- PROFINETSiemens SIMATIC S7-1500 CPU
Every sensor is capture-only. The decoys answer, log, and attribute — they never execute anything and never reach back into your network.
Evidence to leadership
From evidence to a report you can hand to leadership.
- Executive summary, key points, and confidence-rated assessments written by AI — grounded only in cited evidence.
- MITRE ATT&CK technique tables and indicator-of-compromise appendix, auto-assembled.
- Export as PDF or Markdown with every source one click away.
Integrations
Your intel, enforced where you block.
Push indicators straight into the tools your team already runs.
Firewalls
- Palo Alto Networks (EDL + Panorama)
- Fortinet FortiGate (EDL + FortiManager auto-setup)
- Ubiquiti UniFi
SIEM / EDR
- Microsoft Sentinel
- CrowdStrike Falcon
Standards
- TAXII 2.1 server
- STIX
New · Raven AI
An analyst that already knows your environment.
Raven AI is ThreatSpire's security assistant, one click away on every page. Ask it about threat intel, detection engineering or security architecture, or ask about your own organisation, and it answers from your data, not guesswork.
Grounded in your organisation.
Raven sees your exposure to known-exploited CVEs, honeypot activity, campaigns, open cases, intel requirements, indicator verdicts and connected security tools, and tells you which facts it used.
Expert across security disciplines.
CTI and actor tradecraft, detection engineering, security architecture and security engineering. General questions get expert answers; organisation questions get your answers.
Private by design.
Raven runs on ThreatSpire's own self-hosted model. Your data is never sent to a third-party AI service, and answers are clearly labelled as AI-generated.
Try asking
- “Which known-exploited CVEs hit our assets, and what should we patch first?”
- “Who has been attacking our honeypots this week?”
- “How should we segment our OT network?”
- “What does this IOC mean for us?”(on the IOClytics page)
Available everywhere in ThreatSpire. Open Raven from the left navigation, and it follows you from page to page and sees what you're looking at.
How it works
From raw signal to defended decision.
- 01
Ingest
Pull in reporting, vendor feeds, and internal signal.
- 02
Attribute
Map activity to actors and MITRE ATT&CK techniques.
- 03
Decide
Surface priority questions and decision traces.
- 04
Act
Hand analysts evidence-backed answers.
Built for teams
One platform, shared across your analysts.
Why ThreatSpire
Built for analysts who have to defend their conclusions.
Evidence-first, always
No unsourced claims. Every assertion in ThreatSpire links back to the report, feed, or telemetry it came from.
- Source-linked claims
- Auditable decision trails
MITRE ATT&CK-native
Not bolted on. Actors, techniques, and detections share one shared vocabulary from the ground up.
- Group catalog seeding
- Technique-level coverage
Private AI, analyst-controlled
Every AI draft runs on ThreatSpire's own infrastructure. Your actors, requirements and findings are never sent to a third-party AI provider. AI drafts with citations; analysts review and decide.
- Human-in-the-loop drafts
- Citations on every summary
Bring your threat intelligence into focus.
See ThreatSpire on your own actors and requirements.
Live · Deception Grid
Adversary telemetry from the ThreatSpire sensor mesh
Attacks logged
Unique adversaries
Countries of origin
Sensors live
Credentials captured
updated continuously