Chrome extension · in Web Store review

Every indicator on the page, one click from a detection rule.

The Threadlinqs extension highlights IPs, domains, URLs, hashes and CVEs on any site you turn it on for. Click one and you get the curated threat report behind it — and the Sigma, SPL or KQL rule that detects it.

It is going through Chrome Web Store review now. Create a free account and you will be first to know the moment it is live.

Free — no paid plan required to use it

Create a free account Sign in

Takes about a minute. No card, and the extension's enrichment works on the free tier.

How it works

Turn it on per site

Nothing happens anywhere until you enable the extension for that specific site from the toolbar. No standing access to your browsing.

Indicators light up

IOCs and CVE identifiers are found and underlined in place, entirely inside your browser. Nothing leaves your device to do this.

Click for the rule

One click returns severity, the attributed actor, related infrastructure — and the detection rule, ready to paste into your SIEM.

What it reads, stated plainly

It is a security tool, so it should be held to a security tool's standard of disclosure:

Highlighting is fully local. Page text is scanned in your browser to find indicators. No account needed, and nothing is sent over the network to do it.
Only what you click is sent. Clicking a highlighted indicator sends that one value — not the page, not your browsing history — to intel.threadlinqs.com for enrichment.
Off by default everywhere. It runs only on sites you explicitly enable, and stays inert on banking, webmail and login domains even if you enable them.
Permissions are narrow — storage, scripting and activeTab, with per-site host access granted by you.

Full detail in the extension privacy policy. Questions or a problem to report? Contact support.