Skip to main content
ClusterHawk
Sign Up

Platform Documentation

Learn how to use ClusterHawk for IP clustering and threat detection

Search Documentation

1
Submit IPs

Upload your IP addresses of interest through our secure interface. Our platform handles datasets up to 5000 addresses.

2
Analysis

Our deterministic ensemble pipeline analyzes patterns, identifies relationships, and generates threat intelligence automatically — same input, same clusters, same reasoning, every run.

3
Receive reports

Get comprehensive threat intelligence reports with IOCs, YARA rules, and hunting queries.

4
Execute hunting queries

Use our automated hunting query execution service to validate findings and monitor for new threats.

User Guide

Understanding Key Metrics

Understanding Dashboard Metrics

The ClusterHawk Dashboard provides key metrics to help you monitor your usage and account status. The Dashboard is divided into three main sections: Quota Usage, Recent Jobs, and Clustering Statistics.

Quota Usage

The Quota Usage section displays your current resource consumption with progress bars, helping you monitor and manage your subscription limits:

  • IP Addresses: Shows how many IP addresses you've processed out of your total allocation (e.g., 72/500)
  • Predictions: For plans with prediction capabilities, shows how many predictions you've used against your limit (e.g., 0/0)
  • Models: Displays the number of saved models against your storage limit (e.g., 0/0)
  • Concurrent Jobs: Indicates how many jobs you're currently running and your maximum allowed (e.g., 0/1)
  • Hunting Queries: Shows how many hunting queries you've used out of your allocation (e.g., 0/0)
Recent Jobs

This section shows your most recent analysis jobs, including:

  • Job Name and Type: The name you gave the job, followed by two labels — the analysis family (Core, Deep, Advanced or Neural) and the mode (Profiling, Training or Prediction). A job submitted without a name shows its pipeline's display name instead (e.g., "Advanced Infrastructure Profiling")
  • Status: Displays the current status of each job (e.g., completed, cancelled, failed, running)
  • Started: When the job began, shown as a short date and time — hover over it for the full timestamp
  • Completed: When the job finished, shown the same way, along with the total run duration
Clustering Statistics

This section provides detailed statistics about your IP clustering activities:

  • Total IPs Processed: The total number of IP addresses processed across all jobs (e.g., 72)
  • Pipeline Usage: Statistics for each pipeline type (e.g., Core Infrastructure Profiling), including:
    • Total Jobs: Number of jobs run for this pipeline type
    • Completed: Number of successfully completed jobs
    • Failed: Number of jobs that encountered errors
    • Cancelled: Number of jobs manually cancelled by users
    • Pending: Number of jobs waiting to start
    • Running: Number of jobs currently in progress
    • IPs Processed: Total number of IP addresses processed by this pipeline type

Completed jobs in the Recent Jobs list are clickable — selecting one opens its results on the Analysis page. If you have no jobs yet, the list links you straight to the Workspace.

Your Dashboard provides an immediate view of your account status and usage patterns. Check back regularly to monitor your quota usage and ensure you have sufficient resources for your planned analysis tasks.