Active ransomware groups and their indicators of compromise — know the adversary.
Active ransomware groups
Loading...
Ransomware IOCs
Loading IOCs…
—
Relevant actors
—
Saved hunts
—
Techniques tracked
4
SIEM targets
Intel-driven hunts · generate-only
CIOC generates hunts from the actors targeting your sector; you run them in your own SIEM. Execution against your logs and scheduled hunts arrive with environment integration (Phase 2).
AVA
● Platform AI · Azure-hosted
AVA
Autonomous Vigilance Agent
Ask about threats, generate hunt queries, enrich IOCs, or draft reports — grounded in live feeds and your organization profile.
Attack Surface · Your organization
sector: —
0
P1 watchlist alerts
0
P2 watchlist alerts
0
IOC feed matches
0
Terms monitored
WATCHLIST CONFIGURATION
Define what CIOC monitors for your organization. Matches surface in dedicated views:
CVE / Zero-day for vulnerability matches,
Alerts & Cases for vendor risk, dark web, and APT events.
Organization watchlist
ACTIVE WATCHLIST TERMS
Add details above
Auto: every feed refresh · Results in CVE / Zero-day and Alerts & Cases
Domains someone else registered to look like yours — typosquats,
homoglyphs and lookalikes used to phish your customers and staff. You do not
control these, so remediation means a takedown request.
LOOKALIKE DOMAINS
EXPORTscore ≥ 40 · live only · owned and dismissed excluded
Loading…
SOCIAL-MEDIA & EXECUTIVE IMPERSONATION
Impersonation monitoring — see details after scan.
Your own subdomains — forgotten hosts, non-production
environments left on public DNS, and records pointing at deprovisioned
cloud resources someone else could claim. You control these, so
remediation is a DNS change rather than a takedown request.
Leaked credentials & passwords, breaches affecting you or your vendors, dark-web mentions, and ransomware victim-matching
ACTIVE INDICATORS — LIVE THREAT FEEDS + YOUR ENVIRONMENT
Loading active IOCs...
// AD-HOC IOC ENRICHMENT
Paste any IOC — IP, domain, URL, or hash. Defanged forms work (evil[.]com, hxxps://...).
Paste an IP, domain, URL, or hash to begin.
Tip: Ctrl/⌘+Enter to look up
// LOOKUP RESULT
—
—
powered by virustotal · abuseipdb · whois/rdap · hybrid analysis
// AUDIT TRAIL
Loading…
No actions yet. Actions appear here after preview, execute, or failure events.
// ACTION DETAIL
—
—
Open
—
P1 Critical
—
SLA breached
—
Avg MTTR (mins)
SOURCE:
Loading cases...
AI enrichment
Detection details
Timeline milestones
Playbooks & automations
Available playbooks
Automated response actions
Add comment
Case timeline
// RUN RESPONSE ACTION
Preview first, then confirm to execute. Attaches to the open case.
Close case
Create new case
// IOC ENRICHMENT
—
—
powered by virustotal · abuseipdb · whois/rdap
PHASE 2 ROADMAP
Feature name
This capability is on the CIOC roadmap for Phase 2 deployment, available once your pilot converts to an annual contract.
Pilot scope vs Phase 2
The 60-day pilot focuses on the intelligence layer (threat detection, vendor risk, case management, hunt query generation). Document export, scheduling, and email integration ship in Phase 2 — available post-pilot conversion.
—
Total vendors
—
Critical risk
—
High risk
—
Third-party pillar
⚠
Open cases requiring attention
Loading vendors...
Add vendor / technology
REPORTS · DATA-BACKED CTI DELIVERABLES · BOARD AND ANALYST GRADE
Loading Monthly Board Summary…
Team
Members
Roles & permissions
Pending invites
Access audit log
Account
Plan & seats
Team members
Manage who has access to your CIOC workspace.
Seat usage
1 of 5 seats
Upgrade →
Member
Role
Status
Last active
Roles & permissions
Module
Owner
Admin
Analyst
IR
Auditor
Leadership
Threat overview
✓
✓
✓
✓
Read
Read
Hunt + AI
✓
✓
✓
✓
Read
—
Dark web monitor
✓
✓
✓
—
Read
—
CVE tracker
✓
✓
✓
✓
Read
Read
Reports + AI
✓
✓
✓
✓
Read
Read
Team management
✓
✓
—
—
—
—
Billing
✓
—
—
—
—
—
Pending invites
Email
Role
Invited by
Expires
Access audit log
Plan & access
CURRENT ACCESS
Pilot
90-day evaluation period
All 8 modules · Unlimited AI usage Onboarding + weekly check-ins Mid-pilot and final outcome reports
Large org · 5,000+ employees · MSSP white-label available
50% of pilot fee credited toward year one if converted within 30 days of pilot end.
Demo environment Quick setupdemo tenant only
Load pre-configured demo data for your organization — 8 vendors, 5 realistic cases with AI enrichment, org profile, and watchlist. Perfect for demos.
Organization profile
This profile drives all personalized threat intelligence — watchlist monitoring, CVE matching, DRP scans, and APT sector filtering.
One domain only. Put the rest in Additional domains below.
Comma-separated. Other domains you own, monitored alongside the primary.
Domains the lookalike sweep flagged that are actually yours — defensive registrations, mail-only domains, regional sites. Not scanned, not permuted; excluded from the queue, the nightly digest and exports. CIOC re-flags one if its nameservers, mail or registrar change. "Owned by us" on a finding adds it here.
Add a version with @ — e.g. PAN-OS @ 10.2.4. Versions are optional, and let CVE pages tell you whether you're actually affected.
Account
Logged in as
—
—
Organization
—
—
Environment connectors
Connect your security tools so CIOC can pull alerts, run hunts, and push response actions directly in your environment. Credentials are encrypted and stored securely.
Loading connectors...
Threat intel feeds 14 Active
Premium feeds available: Microsoft MDTI · Recorded Future · Mandiant · CrowdStrike · Flashpoint · Intel 471
AI Features — Platform Powered Active
AI is powered by CIOC's platform — no configuration needed. All AI usage is covered by your subscription. AI is hosted on Azure.
—
Chat queries
—
KQL generated
—
IOCs enriched
—
Reports generated
Case management metrics
Loading...
Configure connector
Invite team member
They'll receive an email with a link to set up their account. Invite links expire after 7 days.
Change role
Update this user's access level.
⌨ Hunt Query Generator
Describe what you want to hunt for in plain English. The AI writes the production-ready query for your chosen SIEM, EDR, or universal Sigma format.
GENERATED QUERY
⚡ Generate AI Report
AI writes a professional report from your live threat feed data. No manual writing needed.