AshES CTI Documentation

Local-First Operation

Threat intelligence data is stored locally on the analyst workstation. Reports, extracted indicators, enrichment results, ATT&CK mappings, rule artifacts, and actor intelligence remain under organizational control.

Offline & Air-Gapped Use

AshES CTI supports offline workflows for restricted environments. Organizations can preload intelligence, import files manually, and continue analysis without relying on a cloud-hosted platform.

No Telemetry

AshES CTI does not collect analytics, usage metrics, behavioral telemetry, or customer intelligence data. Normal product usage remains local to the organization operating the software.

Customer-Controlled Data

Intelligence processed inside AshES CTI remains under the organization’s control. The product is designed for teams that require local retention, privacy, and operational control.

VirusTotal Enrichment

VirusTotal enrichment is optional and uses the organization’s own API key. No enrichment data is sent to AshES Cybersecurity as part of the enrichment process.

Cryptographic Licensing

AshES CTI uses cryptographically signed licenses for activation and entitlement validation. Licensing is designed to support both connected and restricted deployment environments.

Security Operations Centers

SOC teams can use AshES CTI to process threat reports, extract indicators, map adversary behavior, review actor context, and export operational intelligence.

• Review threat reports
• Inspect extracted IOCs
• Map activity to ATT&CK
• Export validated intelligence

Threat Intelligence Teams

Threat intelligence teams can use AshES CTI to centralize collection, enrich indicators, review threat actor context, and maintain a local intelligence repository.

• Collect intelligence from supported sources
• Review actor and malware context
• Track ATT&CK-linked activity
• Maintain local intelligence records

Detection Engineering

Detection engineers can use AshES CTI to connect intelligence with detection workflows by reviewing techniques, procedures, malware associations, and supported rule artifacts.

• Review ATT&CK techniques
• Inspect actor procedures
• Work with YARA, SNORT, and Sigma
• Support detection validation workflows

Threat Hunting

Threat hunters can use actor procedures, malware associations, and ATT&CK mappings to guide investigations around adversary behavior instead of relying only on isolated indicators.

• Prioritize relevant adversary behaviors
• Use ATT&CK context for hunting ideas
• Review actor-linked malware
• Investigate related indicators

DFIR Teams

DFIR teams can use AshES CTI to investigate indicators, identify related malware or actor context, and support incident response investigations.

• Investigate suspicious indicators
• Review related adversary context
• Export investigation artifacts
• Support reporting workflows

Managed Security Providers

MSSPs can use AshES CTI to process intelligence from multiple sources, support customer-facing intelligence workflows, and export intelligence in standard formats.

• Process intelligence efficiently
• Review threat actor activity
• Export STIX, TAXII, CSV, and JSON
• Support customer reporting

Air-Gapped SOC Environments

Organizations operating isolated networks can use AshES CTI to maintain threat intelligence workflows without depending on cloud-hosted platforms.

• Import intelligence manually
• Operate without cloud dependency
• Maintain local intelligence repositories
• Support restricted environments

Government & Critical Infrastructure

AshES CTI supports environments where data sovereignty, privacy, local control, and offline-capable cybersecurity workflows are operational requirements.

• Support local data retention
• Reduce cloud dependency
• Operate in restricted environments
• Maintain control over intelligence workflows