About CYBERTHRE.AT
CYBERTHRE.AT is being built as a community for threat hunters, intelligence analysts, security practitioners, and people growing their careers. A place to connect what we know with what we do next.
A shared purpose
Cybersecurity knowledge becomes more useful when people can question it, add context, and put it into practice. An indicator needs an explanation. A hunt needs evidence. A finding needs a next step.
Our direction is to bring threat hunting, threat intelligence, a threat dashboard, and CyberJobs into one community. That connects the technical work with the people learning it, improving it, and finding opportunities to do it.
We’re starting with a member workspace and building toward a place where reviewed intelligence and investigative learning can help others.
Four connected areas
Each area has a role in the community we’re building.
01 / Threat hunting · In development
DarkHound is the threat-hunting capability in development. The project combines SSH-based asset sessions, reusable hunt modules, AI-assisted analysis, and intelligence findings. The aim is to turn investigative knowledge into hunts that others can learn from and reuse.
02 / Threat intelligence · In development
The intelligence direction is to bring indicators, adversary behavior, sources, and analytical context together. Findings should explain what is known, why it matters, and what to investigate next. The current Intel area is a placeholder while this capability is developed.
03 / Threat dashboard · Planned
The planned threat dashboard will bring intelligence and hunting findings into a common view. The goal is to help members connect related activity, understand the supporting evidence, and identify questions that deserve a closer look.
A live threat dashboard is not available yet. This is the direction for a future community overview.
04 / CyberJobs · Available to members
Careers are part of the community, too. CyberJobs lets members search job listings and explore opportunities with AI-assisted answers grounded in retrieved listings. It gives people a practical starting point for their next step in cybersecurity.
How we want to work
Keep sources, scope, and uncertainty alongside the conclusion so someone else can understand and review it.
AI can help organize and explain information. Practitioners assess the evidence and decide what it supports.
The goal is reusable knowledge: clearer questions, stronger hunts, and reviewed lessons that help the next person.
Where we are today
Explore the public pages freely. Member applications sit behind sign-in.
Available today
An invitation-based workspace with account security, passkeys, authenticator apps, and email verification. CyberJobs provides job search and AI-assisted answers.
In development
DarkHound’s integration and the Intel capability are in development. A deployable hunting agent is also planned.
Planned
A shared overview and ways for members to contribute reviewed intelligence and hunts are part of the community direction.
A closer look
Explore an illustrative investigation and the AI principles guiding DarkHound’s development.
Investigation grounded in evidence
DarkHound’s collection design would compare security-tool telemetry with approved checks on the relevant system. Neither integration is available in the current Intel area. This example shows the reasoning the capability is being designed to support.
Illustrative scenario · not a live case
QuestionCould this task provide unauthorized persistence?
ScopeFictional server APP-01; task configuration and creation logs for the preceding 24 hours.
Collection timeNo live collection. Evidence references below are illustrative.
A task definition and a creation event do not establish that the script ran or that an attacker created it.
The combination warrants investigation for possible persistence. It does not confirm compromise.
An approved administrator script, a deployment job or a maintenance exception could explain the task.
The script’s content and origin, execution history, creating account, related activity and confirmation from the system owner.
An AI explanation is an interpretation. The evidence is the collected artifact, event or observation. An investigation must also state what was checked, what was accessible and what remains unknown. No findings within a checked scope does not establish that an environment is safe.
AI with clear boundaries
Today, AI is used in the separate CyberJobs application to help answer questions using retrieved job listings. The application supplies those listings and instructs the model to reference its sources and avoid unsupported claims. DarkHound’s security investigation use of AI is in development.
These investigation controls are requirements for the capability in development. The current Intel area does not run collection or containment tools.
The person behind the project
Created by Ian Redden, drawing on more than 20 years in cybersecurity across investigation, threat hunting, security operations, and product leadership, including roles at Cisco and Thales.
That experience shapes the starting point: ask a useful question, understand the evidence, and make the next step clear. The community direction is to make that knowledge useful to more people.
Find your place
Threat hunters, intelligence analysts, defenders, and people finding their way into cybersecurity belong in the same conversation.
Membership is currently by invitation. On the sign-in page, choose “Have an invitation? Join” to use your invitation.