Skip to main content
ClusterHawk
Sign Up

Platform Documentation

Learn how to use ClusterHawk for IP clustering and threat detection

Search Documentation

1
Submit IPs

Upload your IP addresses of interest through our secure interface. Our platform handles datasets up to 5000 addresses.

2
Analysis

Our deterministic ensemble pipeline analyzes patterns, identifies relationships, and generates threat intelligence automatically — same input, same clusters, same reasoning, every run.

3
Receive reports

Get comprehensive threat intelligence reports with IOCs, YARA rules, and hunting queries.

4
Execute hunting queries

Use our automated hunting query execution service to validate findings and monitor for new threats.

User Guide

STIX Export

STIX Export

ClusterHawk exports analysis results in STIX 2.1 (Structured Threat Information eXpression) format, enabling integration with Threat Intelligence Platforms (TIPs) like MISP and OpenCTI.

What Gets Exported

The STIX bundle includes the following objects derived from your analysis:

  • Grouping (Job Container): A Grouping SDO is the root container that references all analysis objects, enabling navigation of related objects in TIP interfaces.
  • Infrastructure Objects: Each cluster is represented as a STIX Infrastructure SDO with:
    • Cluster identification and size information
    • Infrastructure type (command-and-control, botnet, exfiltration, etc.) inferred from detected malware
    • Confidence scores from the ensemble clustering analysis
    • Top features that define the cluster
  • Malware Objects: When actor labels are detected, STIX Malware SDOs are created with:
    • Malware family name (Cobalt Strike, Emotet, LockBit, etc.)
    • STIX-compliant malware types (remote-access-trojan, ransomware, spyware, etc.)
    • Detection confidence from the actor labeling analysis
  • IP Address Observables: Each clustered IP address is included as a STIX Observable (ipv4-addr or ipv6-addr depending on address type) with optional context:
    • Actor label context (e.g., "Cobalt Strike: 90%") when malware is detected
    • Anomaly context (e.g., "HIGH anomaly: score=15.50, percentile=99.5%") for flagged IPs
    • Combined context when both actor label and anomaly apply
  • Indicators: Anomalous IPs from the Noise Intelligence Mining analysis are exported as STIX Indicators with:
    • Detection-ready STIX patterns for TIP ingestion
    • Severity-based confidence (Critical: 95%, High: 80%, Medium: 60%, Low: 40%)
    • Anomaly score and percentile information
  • Relationships: The bundle includes relationship objects connecting:
    • Infrastructure → IP Address (consists-of)
    • Malware → Infrastructure (controls)
    • Malware → IP Address (communicates-with)
    • Indicator → IP Address (based-on)