Skip to main content
ClusterHawk
Sign Up

Platform Documentation

Learn how to use ClusterHawk for IP clustering and threat detection

Search Documentation

1
Submit IPs

Upload your IP addresses of interest through our secure interface. Our platform handles datasets up to 5000 addresses.

2
Analysis

Our deterministic ensemble pipeline analyzes patterns, identifies relationships, and generates threat intelligence automatically — same input, same clusters, same reasoning, every run.

3
Receive reports

Get comprehensive threat intelligence reports with IOCs, YARA rules, and hunting queries.

4
Execute hunting queries

Use our automated hunting query execution service to validate findings and monitor for new threats.

User Guide

MISP Export

MISP Export

ClusterHawk exports analysis results in MISP-native JSON format for direct import into MISP instances. MISP-native format ensures complete preservation of cluster relationships and enables full threat hunting capabilities.

Why MISP-Native Format

While STIX 2.1 is an industry standard, MISP's STIX importer has limitations with certain relationship types. The native MISP format ensures:

  • Object references are properly imported and visible in MISP Event Graph
  • Full relationship support between clusters and malware objects
  • IPs can be queried by cluster membership for threat hunting
  • Automatic correlation when IPs appear in other MISP events
What Gets Exported
  • Job Container Object: An annotation object is the root container that references all clusters and malware objects, eliminating "Unreferenced Objects" in MISP Event Graph visualization.
  • Annotation Cluster Objects: Each cluster is exported as a MISP annotation object with proper display name in Event Graph:
    • Text attribute with cluster name (e.g., "Cluster 0", "Noise") displayed as the object name in MISP Event Graph
    • IP addresses as ip-dst attributes within the object
    • IP comments with labels (e.g., "Cobalt Strike: 90%") when malware is detected
    • Cluster metadata (confidence, quality, features, products) in the object comment
    • Object References linking to associated malware
  • Deduplicated Malware Objects: When actor labels are detected, a single MISP malware object is created per unique malware family (not per cluster) with:
    • Malware family name and type classification
    • Detection confidence in the object comment
    • Object References to all clusters with that malware (controls relationship)
    • Object References to specific IPs with that label (communicates-with relationship)
  • IP Malware Tags: IP attributes with malware labels are tagged with the malware family name (without confidence) for easy filtering:
    • Single label: malware:cobalt-strike
    • Multiple labels: malware:metasploit, malware:cobalt-strike
  • IDS Flagging: IP attributes include automatic to_ids flag assignment:
    • IPs in malware-associated clusters: to_ids=true
    • Anomalous IPs: to_ids=true with severity and score in comment
    • Combined comments when IP has both label and anomaly (e.g., "Metasploit: 85% | HIGH anomaly: score=15.50, percentile=99.5%")
    • Normal IPs: to_ids=false
  • Event Metadata: The event includes:
    • source:clusterhawk tag for filtering and identification
    • Job ID reference in event info
    • Proper timestamps and threat level configuration
MISP Integration
  • Import: Navigate to Event Actions → Add Event → Import from → MISP format, then upload the JSON file. All objects and relationships are preserved.
  • Event Graph: After import, view the Event Graph to see visual cluster-malware relationships and navigate between objects.
  • Querying: Use MISP's attribute search to find IPs by cluster (via comment text), filter by source:clusterhawk tag, or query IPs with to_ids=true for detection-ready indicators.
  • Correlation: MISP automatically correlates IPs that appear in multiple events, enabling cross-event threat hunting.