Skip to main content
ClusterHawk
Sign Up

Platform Documentation

Learn how to use ClusterHawk for IP clustering and threat detection

Search Documentation

1
Submit IPs

Upload your IP addresses of interest through our secure interface. Our platform handles datasets up to 5000 addresses.

2
Analysis

Our deterministic ensemble pipeline analyzes patterns, identifies relationships, and generates threat intelligence automatically — same input, same clusters, same reasoning, every run.

3
Receive reports

Get comprehensive threat intelligence reports with IOCs, YARA rules, and hunting queries.

4
Execute hunting queries

Use our automated hunting query execution service to validate findings and monitor for new threats.

User Guide

Pipeline Key Steps

Pipeline Operational Details

Each pipeline type performs specific operational steps optimized for its analytical approach. Beyond the core clustering pipelines, specialized utility pipelines provide targeted functionality.

Utility Pipelines
  • Metadata Enrichment: Enriches IP data from Shodan with information without performing clustering analysis. Ideal for data preparation and intelligence gathering. If IP is not found in one enrichment, fallback enrichment source is used. If none return information, then IP is assigned as NIL.
Basic Pipeline Operations

Basic pipelines perform immediate analysis without model training:

  • Infrastructure Analysis: Automated feature analysis and parameter optimization for immediate infrastructure profiling
  • Noise Intelligence Mining: Automatic detection and re-analysis of noise clusters exceeding the minimum threshold to uncover hidden patterns
  • Cluster Labeling: Intelligent assignment of descriptive labels based on cluster characteristics and dominant features
  • Quality Evaluation: Assessment of cluster reliability, coherence, and separation metrics
Training Pipeline Operations

Training pipelines create persistent models for reuse across similar datasets:

  • Model Optimization: Automatic selection and tuning of the optimal model configuration for your specific dataset using the proprietary evaluation framework
  • Feature Engineering: Automated identification of the most predictive feature combinations for your data
  • Model Validation: Cross-validation and performance testing to ensure model reliability and generalization
  • Model Persistence: Secure storage of trained models with metadata for future prediction operations
Prediction Pipeline Operations

Prediction pipelines apply trained models to new data for scalable threat assessment:

  • Model Loading: Retrieval and initialization of previously trained models with their optimal parameters
  • Feature Alignment: Automatic alignment of new data features with the model's training schema
  • Prediction Generation: Application of the trained model to generate cluster assignments for new IP addresses
  • Confidence Assessment: Calculation of prediction confidence scores, top-K candidate clusters, and contract trust-gate (confident_match, ambiguous_diffuse, ambiguous_split, out_of_distribution)
  • Results Integration: Predictions are combined with existing cluster analysis and quality metrics