Skip to main content
ClusterHawk
Sign Up

Platform Documentation

Learn how to use ClusterHawk for IP clustering and threat detection

Search Documentation

1
Submit IPs

Upload your IP addresses of interest through our secure interface. Our platform handles datasets up to 5000 addresses.

2
Analysis

Our deterministic ensemble pipeline analyzes patterns, identifies relationships, and generates threat intelligence automatically — same input, same clusters, same reasoning, every run.

3
Receive reports

Get comprehensive threat intelligence reports with IOCs, YARA rules, and hunting queries.

4
Execute hunting queries

Use our automated hunting query execution service to validate findings and monitor for new threats.

User Guide

Pipelines Overview

Pipelines Overview

ClusterHawk provides four core analysis pipelines designed to meet diverse security analysis needs:Core, Deep, Advanced, and Neural Network. Each pipeline employs different analytical approaches optimized for specific use cases and threat detection scenarios.

Core Pipeline Architecture

Most core pipelines include three sub-pipeline types, each serving distinct analytical purposes:

  • Basic Pipelines: Perform clustering analysis, noise intelligence mining, and labeling without model training. Ideal for exploratory analysis and immediate insights.
  • Training Pipelines: Create and train reusable models that learn patterns from your data, enabling consistent analysis approaches across similar datasets.
  • Prediction Pipelines: Use previously trained models to predict cluster assignments for new IP addresses, providing scalable threat assessment capabilities.

Note: Neural pipelines include only Training and Prediction sub-pipelines due to their specialized deep learning architecture.

Analytical Approaches

The pipelines differ in how they analyze IP metadata before profiling. Each approach is optimized for different analytical objectives:

Feature-Preserving Analysis (Core & Neural Network)

Core and Neural Network pipelines preserve fine-grained feature diversity, maintaining sensitivity to rare indicators. For example, even when analyzing 400 IP addresses, the system preserves features that enable cluster creation for as few as 5 IP addresses. This matters for:

  • Detecting specific threat actor signatures and behavioral patterns
  • Identifying Tools, Tactics, and Procedures (TTPs) through clustering
  • Preserving fine-grained indicators that might be unique to particular adversaries
  • Maintaining sensitivity to rare but significant threat indicators
Structure-Focused Analysis (Deep & Advanced)

Deep and Advanced pipelines focus on revealing structural relationships between clusters, creating exceptionally dense, high-quality groupings. While this approach may trade some granular feature visibility, it excels at revealing the broader infrastructure landscape and is optimized for:

  • Infrastructure mapping and relationship analysis
  • Identifying attack vectors and campaign-level patterns
  • Understanding large-scale threat infrastructure deployments
  • Revealing strategic patterns in adversary infrastructure design
Proprietary Evaluation Framework

The proprietary evaluation methodology is used across all pipeline types. It dynamically assesses multiple clustering methods and determines optimal parameters, feature sets, and weights for each dataset, so results stay high quality regardless of data characteristics or which pipeline you choose. The framework adapts to your specific data patterns and keeps each pipeline type's core analytical strengths intact.