Documentation
Guides, concepts, and reference. Every page links out to the surfaces in the product it describes — so you can jump from reading to running in one click.
Last updated · 2026-04-17
Start here
If you're new, the fastest path from zero to useful threat intel is a single sensor on spare hardware. You'll earn Participant-tier access in 48 hours and pick up the vocabulary — records, Verified Core, Community Mesh — as you go.
- Run a sensor — Docker, Tauri, and what data leaves your box.
- Tiers and limits— rate, history, freshness, and what's paywalled.
Concepts
Two ideas do most of the work in this system: a shared record shape (every public surface renders the same JSON with tier-aware redaction) and a query DSL (search, alerts, and the API all accept the same syntax).
- Query DSL — fields, operators, relative time.
- Alert Triggers — saved queries that flag new matches between visits.
Reference
- REST API — endpoints, auth, response headers, paywall behavior.
- Sensors — install, enrollment, privacy boundary.
Getting started