Skip to main content
ClusterHawk
Sign Up

Platform Documentation

Learn how to use ClusterHawk for IP clustering and threat detection

Search Documentation

1
Submit IPs

Upload your IP addresses of interest through our secure interface. Our platform handles datasets up to 5000 addresses.

2
Analysis

Our deterministic ensemble pipeline analyzes patterns, identifies relationships, and generates threat intelligence automatically — same input, same clusters, same reasoning, every run.

3
Receive reports

Get comprehensive threat intelligence reports with IOCs, YARA rules, and hunting queries.

4
Execute hunting queries

Use our automated hunting query execution service to validate findings and monitor for new threats.

User Guide

Clustering Tab

Clustering Tab

The CLUSTERING tab provides multiple views to help you analyze clusters:

  • Cluster Distribution: Bar chart showing the number of IPs in each cluster and noise. Larger clusters might represent common infrastructure patterns, while smaller ones may indicate specialized or unusual activity. Below the chart, a table lists each cluster's size, evaluation, and representative IPs.
  • Cluster Confidence: The evidence behind each cluster, one row per cluster: its consensus confidence, its content purity where measured, the cluster it most resembles with the share of its defining signals that one carries, its strongest separating signal together with whether that signal is exclusive to it and the signals only this cluster carries, its quality verdict, how much of it held together against earlier analyses of the same addresses, and whether a hunting query exists for it. Anything not measured for a given run is shown as unmeasured rather than as a zero. Rows that resemble more than one cluster expand to list the rest of that ranking, each with the same share, followed by the signals shared with the closest of them. Read the row against its expansion to judge whether two clusters are separate deployments or one deployment the run divided: heavy overlap with little that is unique points at the second.
  • IP Distribution: Detailed view of IP address distribution across clusters. Use this to examine the composition of each cluster and identify representative IPs.
  • Cluster Features: Shows the key characteristics that define each cluster, helping you understand what makes each group unique and what attributes contribute most to cluster formation.
  • Cluster Statistics: Per-cluster statistical profiles covering the organizations, services, certificates, and other characteristics that make up each cluster. Shown when statistical data is available for the job.
  • User-Defined Cluster Labels: Assign custom labels to clusters for easier identification and organization:
    • In the IP Distribution tab, click the edit icon on any cluster card header to add or modify a custom label
    • User labels are displayed alongside auto-detected labels in tooltips across all analysis views
    • Labels persist across sessions and are included in prediction results when using the trained model
    • User labels are distinguished from detection-based labels and can be removed by clearing the label field
  • Cluster Comparison: Dual-mode comparison system for conducting comparative assessments across cluster dimensions:
    • Features Comparison Mode: Side-by-side feature importance comparison showing SHAP/LIME values, representative values, frequency analysis, and cluster-specific interpretations. Identifies shared features, unique features, and importance differentials for precise cluster differentiation.
    • Statistics Comparison Mode: Statistical comparison across organizational profiles, vulnerability analysis, product analysis, certificate analysis, service analysis, naming patterns, and malware indicators for complete cluster profiling.
    • The framework is flexible, letting analysts compare clusters across all these dimensions.
  • Anomalies: A separate anomaly surface from Noise Intelligence Mining's Anomaly Detection Results and the Neighborhood tab's anomaly alerts. It scores every IP by how consistently the clustering ensemble places it across its repeated runs, then lists the least consistent IPs with a severity rating (Critical, High, Medium, Low) and the behavior that drove the score. Only shown when the analysis actually found anomalous IPs.
  • Visualizations: An interactive 3D view of the same clusters, switching between a point-cloud mode (individual IPs with convex-hull cluster boundaries) and a cluster-sphere mode (IPs orbiting their cluster's centroid). See 3D Cluster Visualization for the full breakdown of projection methods and controls.