> ## Documentation Index
> Fetch the complete documentation index at: https://docs.panguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Threat Intelligence
> Real-time threat intelligence feeds and the Threat Cloud collective intelligence network.
# Threat Intelligence
Threat intelligence provides structured information about known attackers, malicious IPs, domains, URLs, and malware signatures. Panguard automatically queries these databases to determine whether activity on your system is linked to known threats.
You do not need to understand the technical details. Guard handles the queries automatically, and
Chat explains the results in plain language.
***
## 5 Built-in Threat Intelligence Feeds
### abuse.ch Suite
| Source | Indicator Types | Description |
| ---------------------------------------------- | --------------------- | ----------------------------------------------------------------------- |
| [ThreatFox](https://threatfox.abuse.ch) | IP, domain, URL, hash | Database of indicators of compromise (IoCs) linked to malware campaigns |
| [URLhaus](https://urlhaus.abuse.ch) | URL | Database of malware distribution URLs |
| [Feodo Tracker](https://feodotracker.abuse.ch) | IP | Botnet Command and Control (C2) server tracking |
### Additional Sources
| Source | Indicator Types | Description |
| ---------------------------------- | --------------- | ---------------------------------------------------------------- |
| [GreyNoise](https://greynoise.io) | IP | Distinguishes targeted attacks from mass internet scanning |
| [AbuseIPDB](https://abuseipdb.com) | IP | Community-reported malicious IP database with confidence scoring |
***
## Feed Update Schedule
| Feed | Update Frequency | Query Type |
| ------------- | ------------------- | -------------- |
| ThreatFox | Every hour | Cached locally |
| URLhaus | Every hour | Cached locally |
| Feodo Tracker | Every hour | Cached locally |
| GreyNoise | Real-time per query | API call |
| AbuseIPDB | Real-time per query | API call |
The 1-hour update interval is configurable. For bandwidth-constrained systems, increase it to 6 or
24 hours.
### Local Caching
Query results are cached locally to avoid redundant lookups:
* Cache duration: 1-24 hours depending on the source
* Cache location: Guard data directory
* Expired entries are cleaned up automatically
***
## Indicators of Compromise (IoCs)
Threat intelligence tracks the following types of indicators:
| Type | Description | Example |
| -------------- | ----------------------------- | ----------------------------- |
| **IP Address** | Known malicious IP | `203.0.113.50` |
| **Domain** | Malicious domain name | `malware.example.com` |
| **URL** | Malicious URL | `http://evil.com/payload.exe` |
| **File Hash** | Malware fingerprint (SHA-256) | `e3b0c44298fc1c149a...` |
| **Email** | Phishing email address | `phish@attacker.com` |
### Automatic Querying
Guard automatically queries threat intelligence when it detects suspicious activity:
```
Suspicious IP 203.0.113.50 connection detected
|
v
Query ThreatFox -> Known C2 server
Query AbuseIPDB -> Reported 1,247 times
Query GreyNoise -> Mass scanner
|
v
Conclusion: High risk -- auto-block + notify
```
***
## Threat Cloud -- Collective Intelligence
Beyond public feeds, Panguard users contribute to and benefit from the Threat Cloud, a community-driven collective intelligence network focused on ATR (Agent Threat Rules) consensus.
### The Crystallization Flywheel
Threat Cloud's core value proposition is the crystallization flywheel -- a self-reinforcing loop where individual scan findings are refined into community-confirmed detection rules:
```
Scan skill ──> Findings ──> TC proposal ──> Consensus (3+ confirmations) ──> Confirmed rule
^ |
└──────────────── Distributed to all scanners ────────────────────────────────┘
```
Each cycle strengthens the network:
1. **Scan** -- Any Panguard scanner (CLI, Website, or Guard) scans an MCP skill
2. **Propose** -- High-severity findings generate an ATR proposal identified by a pattern hash
3. **Confirm** -- Other scanners encountering the same pattern hash confirm the proposal
4. **Promote** -- At 3+ independent confirmations, the proposal is auto-promoted to a confirmed rule
5. **Distribute** -- Confirmed rules are served via `GET /api/atr-rules` to all scanners
6. **Strengthen** -- Scanners load new rules, improving detection, generating more proposals
The pattern hash uses the format `scan:{skillName}:{findingSummary}`, SHA-256 truncated to 16 hex characters. Because all scanners use the same `@panguard-ai/scan-core` library, they produce identical hashes for the same threat pattern regardless of whether the scan originated from CLI, Website, or Guard.
### LLM Reviewer
Threat Cloud includes an automated LLM reviewer (Claude Sonnet 4) that evaluates ATR proposals for false positive risk, coverage, detection specificity, and YAML validity. Proposals can be promoted through community consensus alone (3+ confirmations) or through LLM approval combined with community confirmation.
### IoC Feeds
Threat Cloud also distributes traditional IoC feeds (IP blocklists, domain blocklists) and maintains a community skill blacklist. These complement the ATR rule pipeline for network-level threat indicators.
***
## Privacy and Data Protection
**Privacy guarantee:** Only threat indicators (IPs, hashes, patterns) are uploaded. No system
information, usernames, internal IPs, file contents, or personally identifiable information is
ever shared.
| Privacy Measure | Details |
| --------------------- | --------------------------------------------------------------- |
| **IP anonymization** | Source IPs are /16-anonymized before upload |
| **GDPR compliance** | No personal data is collected or stored |
| **Zero raw data** | No log content, file content, or system details are transmitted |
| **Zero telemetry** | No usage analytics, crash reports, or behavioral tracking |
| **Opt-out available** | Threat Cloud can be fully disabled |
***
## Offline Mode
Panguard works fully offline. When threat intelligence feeds are unreachable:
* Layer 1 rule engine continues operating with locally cached rules
* Previously cached feed data remains available until expiration
* New detections rely on ATR rules and behavioral baselines only
* Score adjustments reflect reduced intelligence coverage
```bash theme={null}
# Disable all external intelligence (rules-only mode)
panguard guard start --offline
```
Offline mode disables Threat Cloud participation and real-time feed queries. Cached data is still
used until it expires.
***
## Viewing Threat Intelligence
### Guard Status
```bash theme={null}
panguard guard status
```
```
-- Threat Intelligence --------------------
Feeds: 5 active, last update 2h ago
IoC matched: 3 in last 24h
Blocked IPs: 12 total
```
### Chat Notifications
When threat intelligence matches activity on your system, Chat notifies you in a format tailored to your user role:
```
[Panguard AI Security Alert]
Your server was communicating with a known malicious server.
That IP has been reported 1,247 times globally.
The connection has been automatically blocked. No action needed.
Risk level: High
Status: Automatically resolved
```
```
[Panguard AI Alert]
Threat Intel Match: 203.0.113.50
Source: AbuseIPDB (confidence: 98%), ThreatFox (tag: C2)
Process: curl (PID 5678) -> 203.0.113.50:443
Action: IP blocked via iptables
Rule: atr/network/c2-communication.yml
```
```
[Panguard AI - Remediation Guide]
Event: Communication with known C2 server detected
Severity: High
Action taken: Auto-blocked IP 203.0.113.50
Recommended next steps:
1. Check if process curl (PID 5678) is legitimate
2. If not, terminate: kill -9 5678
3. Check for other processes connecting to the same IP
4. Run a system scan: panguard scan
```
***
## Related
Deploy your own private Threat Cloud server.
How threat intelligence integrates with the detection pipeline.