Command Center Telemetry Overhaul & OSIRIS OSINT Integration

A threat intelligence dashboard is only as good as the reliability and operational relevance of its data streams. Over the past week, we identified client-side ingestion bottlenecks and orphaned endpoints across our primary dashboard modules. To resolve this, we completed a full telemetry synchronization overhaul across three critical feeds on our Threat Intelligence Center—ensuring real-time execution, clean data rendering, and actionable tactical triage.

Here is what was resolved and how SOC operators and defenders can utilize each stream:

• Ransomware.live Feed: Fixed asynchronous JSON ingestion and parser logic to reliably consume live extortion leak-site dumps. Defenders can monitor emerging adversary claims, identify compromised supply chain vendors or peers in near real-time, and cross-reference active threat groups against internal attack surfaces.
• Global Threat News: Deprecated rate-limited, client-side RSS proxies in favor of direct local ingestion from our automated backend aggregation pipeline. Analysts get high-speed access to breaking headlines paired with pre-cached LLM-generated BLUFs and investigation playbooks without third-party API latency.
• Predictive Intelligence (EPSS): Restored automated delivery of Exploit Prediction Scoring System telemetry. Teams can move past static CVSS severity ratings to proactively prioritize patching for vulnerabilities showing active real-world weaponization and exploitation velocity.

In parallel with this dashboard hardening, we have initiated development on a self-hosted OSIRIS OSINT instance. Our engineering focus is on correlating physical and perimeter sensor telemetry with active cyber events—aggregating automated Flock safety camera datasets, network reconnaissance indicators, and regional threat incidents into a single unified geospatial dashboard. Bridging physical perimeter awareness with cyber threat defense will provide our operational teams with unparalleled contextual visibility across both domains.

Automated Threat Triage: Adding One-Click LLM Playbooks to the Feed

Reading raw threat intelligence bulletins is only half the battle during an active incident—the immediate challenge for any SOC analyst is answering the operational question: "How do we prove whether our organization was actually impacted?" To eliminate manual triage drag, we have upgraded our live intelligence pipeline with an interactive Investigate feature powered by automated LLM analysis.

The backend synchronization engine runs on a twice-daily cron schedule, aggregating articles across multiple industry feeds while scraping the technical body text to formulate actionable Blue Team playbooks. The output is structured around an executive-level BLUF (Bottom Line Up Front) paired with concrete, multi-layered investigation pillars: source repository audits, identity and IAM credential checks, and network/EDR behavioral hunting queries. For non-exploitative or editorial announcements, the model automatically tags the advisory as informational and applies defensive hygiene baselines instead.

To keep the user interface lightning-fast with zero client-side API latency, all generated investigation plans are cached directly into our consolidated feed storage during synchronization. Clicking "Investigate" on any headline in the feed instantly launches the full triage brief in an analyst modal. You can test the workflow directly on our home dashboard or explore the complete, searchable archive on our newly launched News Intel Page.

Standing Up the Blue Team Operations Hub

Following the deployment of our threat intelligence aggregators, we are officially expanding KomplexOnline's scope to address defensive operations directly: I have begun building out our dedicated Blue Team Operations Hub. While tracking external campaigns and evaluating risk surfaces provides crucial situational awareness, internal security operations center (SOC) analysts still need battle-tested, practical engineering artifacts to detect, isolate, and eradicate threats across the enterprise stack.

The core objective of this buildout is to consolidate scattered tactical knowledge into structured, dynamic modules tailored for working defenders. Rather than a flat document library, the mid-tier architecture serves interactive runbooks categorized across email vectors, host-level persistence, web application exploits, and lateral network movement. We are baking in production-tested detection logic for both Splunk (SPL) and Cortex XSIAM (XQL), alongside field-tested regular expressions for log filtering and perimeter inspection.

Beyond detection engineering, the portal incorporates formal SOC governance blueprints—including 30-60-90 day analyst enablement frameworks, Tier 1 through Tier 3 RACI models, and operational benchmark targets for MTTA, MTTI, and MTTR. Explore the initial foundation, test the query repositories, and review our defensive tooling stack on the newly launched Blue Team Operations Page.

Pivoting to Financial Risk Quantification (FAIR)

Following up on our work with threat stoplight indicators, I have officially deployed our second-generation Threat Intel Risk Quantifier Tool to production. While qualitative dashboards provide a great high-level snapshot of current defensive postures, the executive suite consistently demands answers grounded in absolute business metrics: "What is our expected dollar exposure over the next twelve months?"

To solve this, we pivoted entirely away from arbitrary scoring matrices and rebuilt this instance natively using the open **FAIR (Factor Analysis of Information Risk)** framework. The engine takes active sliding-scale vectors controlled by an analyst—Threat Activity Levels derived straight from our CTI feeds, internal Control Maturity percentages, and explicit business asset monthly run-rates—and passes them into an array-optimized, 5,000-trial Monte Carlo simulation using NumPy.

The resulting architecture runs completely in-memory inside an isolated Docker container, avoiding clunky external framework dependencies. We added an interactive multi-tenant sign-in gateway to securely lock down historical records and risk tracking views based on assigned business unit lines. The front-end features a programmatic report writer that compiles deep prose executive briefs instantly. Read through the technical feature breakdown or view the active screenshot gallery directly on our updated Tools Terminal Page.

Deployment: Threat Level Matrix Portal

Today marks the deployment of our custom-built Threat Level Matrix Web Tool inside the Asgard environment. The goal of this project was to bridge the gap between technical risk indicators and executive-level visibility. When aggregating telemetry from distinct operational silos—including Physical Security, Automation, DLP, 3PCRM, and Vulnerability Management—it can be difficult to construct a single, unified narrative regarding a company's real-time risk profile.

This web instance standardizes how we assess risk by collecting and weighting specific evaluation vectors based on global FS-ISAC rating rubrics. Analysts can quickly submit assessments complete with primary threat drivers, data confidence ratings, and tactical remediation steps. The engine then processes this information through a hybrid maximum-impact model to instantly update an executive response playbook and dynamic metrics interface. Furthermore, it logs every transaction locally to a persistent database viewable by you and your organization members to provide and view historical trending across your organization. To see the module specifications and inspect the interface, view the deployment profile on the Tools Terminal Page.

Deployment: OSINT Framework Mirror

I am pleased to announce the successful deployment of a local **OSINT Framework** mirror within our Asgard lab environment. This tool acts as a comprehensive reconnaissance hub, allowing our analysts to systematically map out digital footprints and identify threat actor infrastructure without relying on external third-party sites. By hosting this locally on our Synology infrastructure via Cloudflare Tunnels, we ensure that our intelligence-gathering activities remain private and highly accessible even during external outages. You can now launch this utility directly from the Tools repository to begin exploring advanced reconnaissance workflows.

Threat Intelligence Integration

Welcome to the Director's Blog. This is where I share deep dives into operational technology (OT) cybersecurity and the ongoing projects.

This week we have added a number of Intel feeds and information on active ransomware events and threat actor infomation.

The sidebar to the right provides real-time telemetry from our intelligence pipelines. Click any title to explore the full data set in the Command Center.