Overview#

CRAABS is a community threat intelligence platform. It collects, enriches, correlates and shares indicators of compromise (IOCs) among security practitioners, and it operates its own distributed honeypot network that produces first-hand attack telemetry rather than only aggregating third-party feeds.

Three things make the platform distinct:

• First-hand telemetry. Community honeypots feed real intrusion attempts into the database, not just recycled public lists.
• Behavioral correlation. Attackers are tracked by behavior, not only by IP, so the same operator can be recognized across different addresses.
• Integration first. Everything visible in the interface is reachable through an API, an export format or a webhook.

Creating an account#

1. Go to /join and fill in your name, email and organization.
2. Accept the Terms of Use. Read section 5 carefully: it defines what constitutes misuse of the platform's dual-use data.
3. Submit. Registrations are reviewed manually by an administrator, usually within 24 hours.
4. On approval you receive an email with a temporary password. Change it on first login from /profile.

Membership plans#

Roles and permissions#

Access is governed by role-based access control with 26 granular permissions. Administrators manage roles at /admin/roles and assign them per user at /admin/users.

Dashboard#

The dashboard is the operational overview. It combines a KPI strip (total IOCs, active, high risk, weekly additions, auto-feed volume) with a customizable widget grid.

Customization

• Show or hide widgets from the gear menu in the top right.
• Reorder by dragging a widget from its title bar.
• Resize with the width button in each widget header, cycling one third, one half, two thirds and full width.
• Text size can be set to normal, large or extra large for readability on wall displays.

All preferences are stored in your browser, so each analyst keeps a personal layout without any server load. Use Reset layout to return to defaults.

Available widgets

Search & notifications#

Two lightweight controls live in the top navigation bar on every page and require no configuration.

Global search

Type at least two characters in the search field to get a live dropdown of matching IOCs by value, tag or description. The list respects the same visibility rules as the IOC list itself, so a submitted-but-not-yet-approved indicator never leaks to an analyst who could not otherwise see it. Press Enter to jump to the full, filterable results on /iocs.

Notifications

The bell icon shows a live count of noteworthy events from the last 24 hours: newly created critical IOCs (score ≥ 80), indicators awaiting review if you hold that permission, and critical honeypot events. Clicking an entry navigates straight to it.

IOC management#

Supported types

Adding indicators

Go to IOCs > Add IOC. The type is detected automatically from the value. You can paste several values, one per line, to create them in a batch. Defanged input such as hxxp://evil[.]com is refanged automatically.

Set comma-separated tags and a TLP level at creation time. Tags drive correlation and hunting later, so a consistent tagging convention matters more than volume: prefer a short controlled vocabulary such as botnet, c2, phishing, ransomware, scanner.

Scoring scale

Automatic feeds

Three public sources are imported every six hours: Feodo Tracker (botnet C2 servers), URLhaus (malware distribution URLs) and ThreatFox (mixed indicators). Imported IOCs are flagged auto_feed so they can be filtered, re-scored or archived separately from manual entries.

Quick Check#

Quick Check answers one question fast: is this value known as malicious? Paste an IP, domain or hash at /quick-check and you get the score, tags, country, ASN and the sources that reported it. This is the fastest path for triaging an alert without leaving the platform.

Enrichment#

Enrichment adds external context to an indicator. Open an IOC and use Enrich, or call the enrichment route programmatically. Configured providers are queried through a dispatcher that handles failures gracefully: if one provider is unavailable, the others still return.

API keys for third-party providers are configured at /api-settings. Providers without a key are simply skipped.

Reporting to AbuseIPDB / VirusTotal#

For IP indicators, the detail page offers a Report this IP panel to contribute a confirmed malicious IP back to the community databases you already query during enrichment.

Every submission requires an explicit confirmation and is permanent: neither service offers a straightforward way to retract a report or vote once sent. The panel shows the reporting history for that IOC (who reported it and when) so you can avoid duplicate submissions.

ML scoring#

Each IOC receives a 0-100 malicious score from a weighted additive model. The model is deliberately transparent: no black box, no external ML dependency, and every point of the final score can be traced to a named feature.

Feature families

• Type: hashes and URLs weigh more than bare domains.
• Geography: high-risk source countries and unknown origin.
• Source: Feodo, URLhaus and ThreatFox carry different confidence.
• Tags: ransomware, C2, exploit and botnet are the heaviest.
• MITRE tactics: impact, exfiltration, C2, initial access.
• Enrichments: presence and number of positive verdicts.
• Age: recent indicators score higher, indicators older than 30 days are penalized.
• Watchlist and ASN: watchlisted values and known bad autonomous systems.

Analyzing a score

At /ml-scoring, enter an IOC value or ID under Analyze an IOC. You get the computed score with a per-feature breakdown showing exactly how many points each feature contributed, plus a comparison with the score currently stored in the database.

Re-scoring the database

Re-scoring runs in batches of 500 driven from your browser, so a large database is processed without ever blocking the server. Progress is displayed live and can be interrupted and resumed. The auto-feed only option is enabled by default and preserves scores that analysts set manually.

Tuning weights

Weights can be adjusted with sliders and saved. Changes apply to subsequent scoring; run a re-scoring pass to propagate them to existing indicators. Weight changes are recorded in the audit log, and Reset to defaults restores the calibrated model.

CRAABS Score#

The score is computed on demand, on every page that shows it, from data already in the platform. Nothing is written back to the IOC record, so there is no synchronization to worry about.

The weighted total is then multiplied by the IOC's confidence value (floor 0.5), and discounted up to 15% if the indicator has not been re-checked in over 90 days, since stale infrastructure intelligence loses reliability quickly.

The badge is visible on the IOC list, the IOC detail page, both dashboard tables, campaign details, threat hunt results and the IOC review queue. Hover any badge for a breakdown tooltip (external average, honeypot hits, staleness).

Threat hunting#

The hunting interface at /hunt accepts a compact query syntax. Operators can be combined and are evaluated together.

TYPE:ip SCORE:>80 COUNTRY:CN NOT:whitelist

A useful pattern for weekly review: SCORE:>70 NOT:feed surfaces high-confidence indicators that your own team contributed rather than imported.

Correlation#

Correlation finds indicators related to the one you are investigating, across five dimensions: same /24 subnet, same ASN, same ISP, shared tags, and membership in the same campaign. Subnet correlation is often the fastest way to discover that a single scanning IP is part of a wider block worth blocking as a range.

MITRE ATT&CK and Kill Chain#

Indicators are mapped to MITRE ATT&CK tactics and techniques, automatically where tags allow and manually from the IOC detail page. The /mitre view shows coverage across tactics; the auto-mapping action fills gaps for indicators that have none.

The /killchain view organizes the same data along the seven Lockheed Martin phases: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives. Coverage gaps in this view are a useful indication of where your visibility is thin.

Campaigns and threat actors#

Campaigns group indicators that belong to a single operation. Threat actors describe the entity behind them. Linking IOCs to a campaign turns a flat list into an investigation: correlation, exports and dossiers all become campaign-aware.

A practical workflow: create the campaign as soon as you see a second related indicator, attach indicators as they surface, and record attribution in the actor record only when evidence supports it.

Watchlist#

The watchlist holds values you want to be alerted about. When a watchlisted value appears with a score of 50 or higher, an alert is raised. Watchlist membership also adds weight in the ML model, so monitored values naturally rank higher.

YARA scanner#

The scanner at /yara matches uploaded files against your own YARA rule set and, on a match, can automatically create the corresponding hash IOC and send an alert — closing the loop between static file analysis and the rest of the platform.

Scanning a file

Drag a file onto the Scanner tab, or click to browse. The upload progress and the analysis phase are shown separately, since the scan itself is near-instant while the upload can take longer for large files. Results list every matched rule with its tags; a clean file explicitly states no rule matched rather than showing an empty screen.

Managing rules

Every rule tracks who created or last modified it and when, and whether it was typed manually or imported, regardless of what the rule's own meta: block says.

Performance and IOC linkage

Compiled rules are cached in memory and only recompiled when a rule file actually changes, so scanning stays fast even with several hundred rules loaded. On a match, the scanner best-effort creates or updates a sha256 IOC for the file (source YARA Scanner, tagged with the matched rule names) and sends an alert through the existing notification channel. Both steps are wrapped independently: if IOC creation or alerting fails for any reason, the scan result itself is still returned normally.

Honeypot network#

A honeypot is a decoy service that exists only to be attacked. Every connection attempt is by definition suspicious, which makes honeypot data unusually clean compared to production logs.

Installing a node

curl -sSL https://cti.craabs.com/docs/install_honeypot.sh -o install.sh
sudo bash install.sh

The installer configures either Cowrie (SSH and Telnet emulation, records commands and credentials) or OpenCanary (multi-service: HTTP, FTP, SMB, RDP and more), plus the CRAABS connector and an auto-start service.

Registering the node

1. Go to SOC > Honeypot Network and register a new honeypot.
2. Copy the generated key, in the form chp_....
3. Provide it to the installer, or write it into the connector configuration.
4. The node appears as active once its first heartbeat is received.

CHP protocol#

The CRAABS Honeypot Protocol lets any custom sensor report to the platform. Authentication uses the node key in the X-Honeypot-Key header.

Reporting an event

curl -X POST https://cti.craabs.com/api/honeypot/event \
  -H "X-Honeypot-Key: chp_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "source_ip":     "203.0.113.47",
    "honeypot_type": "ssh",
    "event_type":    "login_attempt",
    "dest_port":     22,
    "username":      "root",
    "password":      "123456",
    "severity":      "medium",
    "tags":          ["brute_force", "ssh"]
  }'

Attacker dossiers#

When an IP generates five or more events, an investigation file is generated automatically at /dossiers. It contains the chronological timeline, credentials tried, commands executed, organization and ASN, other addresses seen in the same /24, a community trust score and a behavioral fingerprint.

Community trust score

A 0-100 confidence value built from how many distinct honeypots saw the address, how many protocols it targeted, how long it stayed active and its total event volume. An address seen by many independent sensors is far more reliable evidence than one seen once.

Behavioral fingerprint#

Each attacker receives a SHA-256 fingerprint computed from typical activity hours, command sequences, normalized credential lists and port targeting order. When two different addresses share a fingerprint, the platform flags them as the same operator.

This is what allows tracking through VPNs, Tor exit rotation and disposable cloud instances: the address changes, the habits do not.

Canary URLs#

A canary URL is a trap link that silently alerts you when a document is opened. Create one at /canary, then embed it in the file you want to monitor.

<img src="https://cti.craabs.com/c/TOKEN" width="1" height="1">

When the token is fetched, you receive an email alert with the source IP, country, ISP, user agent and referrer. Typical uses are detecting exfiltration of a sensitive report, or identifying which partner leaked a document shared under NDA.

Threat forecast#

Using 30 days of honeypot history, the platform projects attack probability per hour for the next 24 hours, the most likely targeted protocols, probable source countries and an overall trend of rising, stable or falling. The forecast is recomputed nightly at 02:30 UTC and surfaced both at /forecast and on the dashboard.

The practical use is scheduling: aligning on-call coverage or maintenance windows with predicted quiet hours.

Live attack heatmap#

A real-time 3D globe of attacks against your honeypots at /heatmap, rendered as an orthographic projection rather than a flat map so the display reads as an actual globe rather than an atlas page. Attack arcs animate from source to destination, refresh every 10 seconds, and are filterable by protocol.

The globe rotates slowly and continuously by default; only one hemisphere is visible at a time, exactly as it would be looking at Earth from space. Rotation is purely client-side rendering and issues no extra network requests. Active attack arcs and dots track the rotation in real time so they stay anchored to their true source and destination instead of drifting as the globe turns under them. Use Pause rotation to freeze the view, for instance to inspect a specific region.

It doubles as a situational display for a SOC wall.

REST API#

The API is available from the Developer plan. Retrieve your key at /api-settings and send it in the X-API-Key header. Keys can be regenerated at any time, which immediately invalidates the previous key.

GET /api/v1/iocs

curl -H "X-API-Key: YOUR_KEY" \
  "https://cti.craabs.com/api/v1/iocs?type=ip&per_page=100"

Response

{
  "iocs": [
    {
      "id": 1337,
      "value": "203.0.113.47",
      "type": "ip",
      "tags": "tor,botnet,ssh_scanner",
      "source": "feodo",
      "tlp": "WHITE",
      "score": 92,
      "status": "active",
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt",
      "created_at": "2026-05-23T10:00:00",
      "updated_at": "2026-05-24T08:12:00"
    }
  ],
  "total": 1250,
  "page": 1,
  "pages": 13
}

GET /api/v1/iocs/:id

Returns a single indicator with its enrichments.

POST /api/v1/iocs

curl -X POST https://cti.craabs.com/api/v1/iocs \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "value": "evil.example.com",
    "ioc_type": "domain",
    "malicious_score": 75,
    "tlp": "GREEN",
    "tags": "phishing,malware",
    "description": "Phishing domain observed in campaign X"
  }'

Errors

Splunk integration#

CRAABS exposes native endpoints that feed Splunk Enterprise Security KV Store collections directly.

# 1. Install the add-on
tar -xzf TA-craabs-feed_v1.0

# 2. Configure your API key
nano $SPLUNK_HOME/etc/apps/TA-craabs-feed/local/craabs_feed.conf
# api_key = YOUR_CRAABS_API_KEY

# 3. Restart Splunk
$SPLUNK_HOME/bin/splunk restart

Splunk then pulls every 5 minutes into ip_intel, domain_intel, url_intel and file_intel.

Filter parameters

Correlating with your traffic

index=firewall OR index=network
| lookup craabs_ip_intel src_ip AS src OUTPUT craabs_score, country, tags
| where isnotnull(craabs_score) AND craabs_score >= 50
| table _time src_ip dest_ip craabs_score country tags
| sort -craabs_score

STIX 2.1 export#

Available on the Pro plan at /export/stix. Indicators are emitted as a STIX 2.1 bundle with pattern expressions, suitable for import into MISP, OpenCTI, TAXII servers and most commercial platforms. Filters applied in the interface, including TLP level, are honoured in the generated bundle.

SIEM export (CEF and Syslog)#

At /export/siem, indicators can be exported in ArcSight CEF or Syslog format for platforms without a native connector, including QRadar, LogRhythm and Sentinel via a generic collector. CSV export is also available at /export.csv for spreadsheet analysis and ad hoc lookups.

Webhooks#

Webhooks push events to your own systems as they happen. Configure endpoints at /webhooks, where each one can be enabled, disabled and tested independently. A typical payload notifies your chat platform or ticketing system when a high-score indicator appears.

{
  "event": "ioc.created",
  "ioc": {
    "value": "203.0.113.47",
    "type": "ip",
    "score": 92,
    "tags": "botnet,c2"
  },
  "timestamp": "2026-08-09T14:22:11Z"
}

Playbooks#

Playbooks at /playbooks chain automated response actions against an indicator: enrich, correlate, add to watchlist, notify. Each execution is recorded with its result, so a playbook run is auditable after the fact. Playbooks are the bridge between detection in CRAABS and action in your own stack.

Third-party enricher configuration#

Add provider API keys at /api-settings. Keys are stored per platform instance and used only for outbound enrichment calls.

Administration#

Handling registration requests

Pending requests can be reviewed individually, or filtered with Select suspicious requests, which highlights automated signups by name and organization patterns. Review the selection visually before rejecting: the filter is a heuristic, not a verdict. Bulk rejections are silent by design and send no email, since spam registrations typically use spoofed addresses belonging to real people.

Email alerts

Connection security#

The dashboard at /admin/connections surfaces who is attempting to log in, aggregated from the existing audit log — no separate tracking system, so the data is exactly as complete as your audit history for the selected window (24h, 7, 30 or 90 days).

Each distinct IP is listed with attempt counts, successes, failures, account lockouts triggered and the distinct set of email addresses tried from it. An IP is automatically flagged suspicious when it shows any of the following:

• 10 or more failed logins in the selected window
• At least one account lockout triggered
• At least one anti-bot signup block triggered
• 4 or more distinct accounts attempted from the same IP — a classic sign of credential stuffing

Geolocation is looked up on demand per IP via the Locate button rather than eagerly for the whole list, to avoid burning external API quota on a page that can list hundreds of addresses.

Security model#

• Sessions expire after 30 minutes of inactivity.
• Lockout after 5 failed logins for 15 minutes, permanent after 10.
• Anti-timing delay of 280 to 480 ms on authentication, so response time does not reveal whether an account exists.
• Transport is HTTPS only with HSTS enabled.
• Content Security Policy is enforced strictly.
• RBAC with 26 granular permissions.
• Audit logging of every action, immutable from the interface.
• Signup protection against automated registration.

TLP and sharing#

TLP travels with the indicator through exports and API responses. When in doubt, classify one level more restrictively: you can always relax it later, but you cannot recall data that has already been shared.

Data retention and archiving#

Archived indicators remain searchable and can be restored at any time. The active table is kept around 50000 indicators for query performance while total storage stays effectively unlimited.

Troubleshooting#

My honeypot does not appear as active

The node is marked active only after its first heartbeat. Check that the connector can reach /api/honeypot/ping outbound on port 443, that the key was pasted without surrounding whitespace, and that the service is running. Regenerate the key if it may have been truncated.

The API returns 401

The header is X-API-Key, not Authorization. Confirm the key at /api-settings and check that it has not been regenerated since your client was configured.

Enrichment returns nothing

The provider key is missing or its rate limit is exhausted. Providers without a configured key are skipped silently by design so that one missing key never blocks the others.

Splunk lookups return no matches

Verify field naming in your lookup definition, and confirm the feed actually contains data at your threshold by opening the endpoint with min_score set lower in a browser.

My account request is still pending

Requests are reviewed within 24 hours. After 48 hours, contact contact@craabs.com.

FAQ#

Is the Community plan really free?

Yes, and it will remain free. Developer access is free during the beta; any future change comes with at least 30 days notice.

Are my manually added indicators ever deleted automatically?

No. Only auto-feed imports are subject to archiving. Manual contributions are kept indefinitely.

Who owns the data I contribute?

You do. Contributing grants the platform a non-exclusive licence to store and redistribute it to the community. You can request removal at any time.

How do I report a false positive?

Open the indicator detail and use Report as false positive. An administrator reviews it.

Can I run my own instance?

The platform is operated as a community service. For self-hosting or research collaboration, contact the team.

Why is this documentation only in English?

Technical documentation changes with every release, and maintaining several translations reliably is not realistic for a community project: an outdated translation causes more harm than an English page. Security tooling and standards such as MITRE ATT&CK are English-first, so the terminology is already familiar to the audience. The Terms of Use, which carry legal weight, are translated into 7 languages.

Glossary#

IOC

Indicator of Compromise. An observable such as an IP, domain, URL or file hash associated with malicious activity.

TLP

Traffic Light Protocol. A four-level convention (white, green, amber, red) that states how widely information may be shared.

Honeypot

A decoy system deployed to be attacked, producing high-signal telemetry about attacker behavior.

CHP

CRAABS Honeypot Protocol. The HTTP interface honeypot nodes use to report events.

C2

Command and Control. Infrastructure an attacker uses to control compromised machines.

ASN

Autonomous System Number. Identifies the network operator responsible for a block of addresses.

MITRE ATT&CK

A knowledge base of adversary tactics and techniques, used as a common vocabulary for describing attacker behavior.

Kill chain

A seven-phase model describing an intrusion from reconnaissance through to actions on objectives.

Enrichment

Adding external context to an indicator from third-party sources.

Behavioral fingerprint

A hash of an attacker's habits, used to recognize the same operator across different addresses.

Canary token

A trap resource that silently reports when accessed, revealing unauthorized document access.

STIX

Structured Threat Information Expression. A standard format for exchanging threat intelligence between platforms.

CEF

Common Event Format. A log format widely accepted by SIEM platforms.

False positive

A benign item incorrectly flagged as malicious.

Defanging

Rewriting an indicator so it cannot be clicked accidentally, as in hxxp://evil[.]com.