Threadlinqs Intelligence — Platform Statistics
Threadlinqs Intelligence is a free, public cyber-threat-intelligence corpus. Each profiled threat carries deployable detection logic in Splunk SPL, Microsoft KQL and Sigma, extracted indicators of compromise, enriched CVE references and MITRE ATT&CK technique mapping. The figures below describe the entire corpus, not a sample.
Data as of . Corpus counts are recomputed nightly; last recomputed .
- 3,252 profiled threats
- 29,707 detection rules across SPL, KQL and Sigma
- 79,376 indicators of compromise (IOCs)
- 721 attributed threat actors
- 865 distinct techniques observed — 820 MITRE ATT&CK techniques plus 45 MITRE ATLAS (adversarial-ML) techniques
- 754 techniques observed on more than one threat, the basis of cross-threat correlation
- 4,003 prioritized CVEs in the live vulnerability feed
Corpus composition
Share of the 3,252 profiled threats by assessed severity:
| Severity | Threats | Share of corpus |
|---|---|---|
| CRITICAL | 932 | 28.7% |
| HIGH | 1,842 | 56.6% |
| MEDIUM | 425 | 13.1% |
| LOW | 22 | 0.7% |
| Other (informational or unrated) | 31 | 1.0% |
By threat category
The eight largest categories by threat count:
| Category | Threats | Share of corpus |
|---|---|---|
| VULNERABILITY | 996 | 30.6% |
| MALWARE | 807 | 24.8% |
| SUPPLY CHAIN | 305 | 9.4% |
| PHISHING | 250 | 7.7% |
| RANSOMWARE | 237 | 7.3% |
| THREAT INTEL | 217 | 6.7% |
| APT | 191 | 5.9% |
| DATA BREACH | 94 | 2.9% |
Sources and related views: daily debriefs, live CVE feed, ATT&CK coverage map. Browse the corpus: Threat actors, CVEs, ATT&CK techniques, Vendors, Weaknesses (CWE), Daily debriefs. Programmatic access via the MCP server and REST API (Purple tier). Free machine-readable feeds: STIX 2.1, MISP and a C2 blocklist.
Threadlinqs Intelligence — Real-Time Threat Detection Platform
Live intelligence console