Skip to main content
ClusterHawk
Sign Up

Platform Documentation

Learn how to use ClusterHawk for IP clustering and threat detection

Search Documentation

1
Submit IPs

Upload your IP addresses of interest through our secure interface. Our platform handles datasets up to 5000 addresses.

2
Analysis

Our deterministic ensemble pipeline analyzes patterns, identifies relationships, and generates threat intelligence automatically — same input, same clusters, same reasoning, every run.

3
Receive reports

Get comprehensive threat intelligence reports with IOCs, YARA rules, and hunting queries.

4
Execute hunting queries

Use our automated hunting query execution service to validate findings and monitor for new threats.

User Guide

Prediction Tabs

Prediction Tabs (Model Information & Predictions)

For prediction jobs, two specialized tabs are available:

  • Model Information: Shows details about the model used for predictions, including:
    • Model type and architecture
    • Training information and date
    • Performance metrics from the training phase
    • Feature weights and importance rankings
    • Model composition for ensemble models
    • Evaluation metrics like accuracy, precision, recall, F1 score
    • Metrics like ROC AUC and log loss when available
  • Predictions: Displays prediction results for each IP address:
    • Predicted cluster assignments with confidence scores. Out-of-distribution rows render "No match" instead of a cluster id and have null confidence. This is intentional, to prevent silent false positives.
    • Kind chip: the contract's trust gate (confident_match, ambiguous_diffuse, ambiguous_split, out_of_distribution). Read this first when triaging a row.
    • Expandable detail row surfaces the candidate cluster set with per-candidate confidences, the top1 − top2 gap, and effective_n.
    • Actor labels applied based on cluster assignment
    • Cluster distribution overview (with an explicit out-of-distribution bucket) to understand the broader prediction patterns
    • Filter by kind, cluster, IP, confidence range, or label; sort by IP, cluster, confidence, kind, or effective_n