Ingest
27 default feeds — abuse.ch, dshield, OTX, MISP, CISA KEV, GreyNoise, urlhaus, phishtank, ransomware leak sites — plus a normalised STIX/TAXII pipeline for your commercial subscriptions. Feeds dedupe, expire, and enrich on the way in.
Platform
Six pillars.
One Postgres.
CTP247 is a single application surface backed by one database — not a SOAR plus a TIP plus an ASM strung together. The fewer the boundaries, the fewer the places state can rot.
Modules
Six modules, each with a deep-dive.
Every module is a full subsystem with its own collectors, scoring, and agent — and they all write into the same alerts, cases, and evidence store.
Pipeline
From feed item to takedown.
One pipeline owns the journey. No hand-offs between products, no context lost at the seams.
Triage
An LLM agent reads each new entry against your declared tech stack and brand. Hits become alerts with reasoning and recommended action; misses get dropped without burning analyst time.
Investigate
Every alert can be handed to an investigation agent that pivots through actor, asset, IOC and case history. Output is a final assessment, a tool-call trace, and findings ready to promote into a case.
Hunt
A weekly hypothesis-driven hunt picks an active threat-actor cluster, cross-checks their TTPs against your environment, surfaces gaps. Ad-hoc hunts run from the dashboard.
Brand
Continuous typosquat detection, certificate-transparency stream watch, AI similarity scoring. When a hit is high-confidence, the agent drafts the takedown but stops at human approval.
Cases
Alerts and findings escalate into cases with state machine, SLA tracking, assignee, comments, and a copilot that updates the timeline as you work. Closing a case generates the report.
Stack
Boring tech, deliberately.
We didn't pick a vector DB just to have one. Postgres holds the indicators, the cases, the agent traces, the audit log. JSONB where shape is fluid, schemas where it isn't.
The whole platform is one Compose stack. Spin it up locally, in your VPC, or on bare metal. The same code paths run in dev as in your production.
Integrations
Speaks the protocols you already use.
CTP247 is a polite citizen in a SOC. STIX/TAXII feeds in, STIX feeds out. IOCs to your detection stack, alerts to the channels your teams actually watch.
Standards
- STIX 2.1
- TAXII 2.1
- MITRE ATT&CK
- MISP
- OpenCTI
Open feeds
- abuse.ch
- dshield
- OTX
- CISA KEV
- GreyNoise
- urlhaus
Detection
- Wazuh
- Suricata
- GreyNoise
- Shodan
Notify & page
- Slack
- Teams
- PagerDuty
- Opsgenie
- SMS
- webhooks