r/threatintel

I've been working on a threat intelligence dashboard that pulls together vulnerabilities, exploits, advisories, malware, ransomware activity, and threat actors into one place. The goal is to cut through the noise and show what actually matters right now.

The main dashboard shows at a glance how many CVEs are actively exploited, critical CVEs, zero-days and ransomware activity over the last 30 days, plus new CVEs and indicators. There's a priority queue that scores and ranks vulnerabilities using CVSS, CISA KEV status, known exploitation, ransomware use, and RCE potential, so the most urgent items rise to the top. It also tracks KEV deadlines (due today / overdue) and charts 30-day volume trends.

Other features include ATT&CK matrix mapping, industry and country views, IOC tracking, and a search bar that supports CVE IDs, hashes, and boolean queries like "remote code execution" AND fortinet.

Would love feedback from anyone working in SOC, vuln management, or CTI. What would you want to see added?

New Version: UserSearch Forensic Capture 1.4.0 is here. A free alternative to Hunchly or ForensicOSINT.

Capture the conversation—not just the post.

✅ Auto-Capture comments on YouTube, TikTok, Facebook, Insta & more.
✅ Auto-expand selected comment threads
✅ Auto-scroll and capture comments
✅ Record browser video & tab
✅ Export PDF & Excel
✅ Free. Local. Private.

🔒 Evidence stays on your device. No evidence uploads.
💸 Every feature free. No subscriptions or paywalls.

Built for investigators. Free to the community.

Watch the update below.

Live now in Chrome Store:

https://chromewebstore.google.com/detail/forensic-web-capture-cour/ncgfnhacjiahmclmephmjaceeeamdama

Edit : adding product page from request

https://usersearch.com/product/forensic-capture/

SoftPerfect NetScan, Advanced IP Scanner and Advanced Port Scanner keep showing up in the discovery phase before encryption. This is the Defender Advanced Hunting query I use to sweep for all three. It matches on PE vendor metadata and the operator flag pairs, not the file name:

let CompanyKeywords = dynamic(["Famatech", "SoftPerfect"]);
let ProductKeywords = dynamic(["Advanced IP Scanner", "Advanced Port Scanner", "Network Scanner"]);
let DescKeywords    = dynamic(["Advanced IP Scanner", "Advanced Port Scanner", "Application for scanning networks"]);
DeviceProcessEvents
| where Timestamp > ago(30d)
| where ProcessVersionInfoCompanyName has_any (CompanyKeywords)
    or ProcessVersionInfoProductName has_any (ProductKeywords)
    or ProcessVersionInfoFileDescription has_any (DescKeywords)
    or ProcessCommandLine has_all ("/portable", "/lng")
    or ProcessCommandLine has_all ("/hide", "/auto")
| project
    Timestamp, DeviceName, AccountName, FileName,
    ProcessCommandLine, ProcessVersionInfoCompanyName,
    ProcessVersionInfoProductName, ProcessVersionInfoFileDescription,
    SHA256, InitiatingProcessFileName,
    InitiatingProcessCommandLine, InitiatingProcessParentFileName

The video walks through it on lab telemetry, plus the Elastic ES|QL version, a tool-agnostic network-sweep query, and how to tell an admin from an operator: https://youtu.be/Iun8zko6EZk

MCP servers and AI skills execute code directly in your local environment. Most people install them from GitHub without any vetting. I have been guilty of doing the same, so I wrote AgentVetter to help me and other fellow developers.

AgentVetter runs each of them in an isolated Modal sandbox first, scans it with Snyk, Cisco and Tessl scanners, and stores the report before anything touches your machine.

It was built at Cursor's Cybersecurity Hackathon in London, now under active development.

Stack: Python, TypeScript, Modal (sandboxing), Snyk/Cisco/Tessl adapters, Supabase. Superlinked (SIE) and other cloud/model providers for access to models.

Would love feedback on the threat model or the sandboxing approach — happy to discuss tradeoffs in the comments.

GitHub: https://github.com/neomatrix369/AgentVetter
Mock dashboard: https://neomatrix369.github.io/demos/agentvetter-dashboard/