ThreatDBby Probatio
Book a callLive demo
Probatio Cyber Defence GmbH·Threat Intelligence Engine

Classify every outbound IP before it becomes an incident

ThreatDB connects your Zeek network log streams to scheduled ESQL detection pipelines. It isolates periodic C2 beacons, queries multi-source threat intelligence, maps internal host connections, and maintains an explainable database of indicators ready for firewall blocking.

Explore live demoBook a technical call
Zeek & Elasticsearch nativeAutomated VT & AbuseIPDB enrichmentDeterministic query replayDual-sided internal/external mapping
threatdb.demo.local / dashboardLive Synthetic Feed
Total External IPs
1,428
Total Internal Hosts
384
Suspicious IPs
47
Last 24h Hits
12
Unenriched Columns
0
IP AddressGeoASNTagsAbuse ScoreVirusTotalC2 ScoreSuspiciousLast Seen
185.220.101.5DEAS205100tor-exit, c2-beacon100%14/9085Yes2 min ago
45.154.255.89RUAS44050scanner, brute-force88%22/9078Yes14 min ago
103.235.46.191SGAS13335phishing-drop65%8/9062Yes1 hour ago
198.51.100.42USAS15169direct-ip, no-dns0%0/9045No3 hours ago

Detection Pipeline

From passive network sensors to explainable indicator records

ThreatDB runs scheduled detection pipelines directly against your indexed network logs. It extracts suspect communication patterns, gathers external threat intelligence, and delivers a scored review queue.

01

Passive sensor ingestion

Zeek connection and DNS log streams index continuously into Elasticsearch. The collector operates purely on network metadata without endpoint agents or inline latency.

conn.logdns.logElasticsearch
02

Scheduled ESQL query execution

Every 12 hours, pre-configured and custom ESQL queries evaluate rolling connection windows to identify periodic intervals, timing jitter, and direct-to-IP egress.

ESQL12h CadenceBeacon Math
03

Multi-source enrichment

Each candidate IP is queried against VirusTotal, AbuseIPDB, and ASN registers. ThreatDB verifies whether prior internal DNS resolution occurred and checks firewall logging flags.

VirusTotalAbuseIPDBASN / GeoIP
04

Decision queue & firewall block

Scored indicators populate the review dashboard with full evidence chains. Analysts can whitelist benign infrastructure or export block rules directly to firewalls.

SQLite StoreOne-Click WhitelistFirewall Export
pipeline_c2_beacon.esql
ESQL Query
FROM logs-zeek.conn-*
| WHERE destination.address IS NOT NULL
    AND destination.geo.country_iso_code != "AT"
    AND @timestamp >= NOW() - 12h
| EVAL interval_bucket = DATE_TRUNC(1h, @timestamp)
| STATS
    connection_count = COUNT(),
    distinct_internal = COUNT_DISTINCT(source.address),
    total_bytes = SUM(destination.bytes)
  BY destination.address, destination.as.organization.name
| WHERE connection_count >= 12 AND distinct_internal <= 2
| SORT connection_count DESC
| LIMIT 50
Result: Extracted 4 candidate C2 destinations for enrichment and internal host cross-referencing.

Detection Scope

Dual-sided visibility across internal and external endpoints

Scoring an external IP in isolation only gives half the picture. ThreatDB links external indicator reputation directly with internal network footprint and agent telemetry.

External indicator intelligence

Every external IP discovered during query cycles is automatically classified across reputation databases, autonomous systems, and hosting attributes.

  • Reputation:VirusTotal malicious score and AbuseIPDB confidence metric
  • Infrastructure:ASN owner, ISP, GeoIP location, Tor exit and proxy flags
  • Pivot links:Direct links to Kibana Discover 1-year timeline and VT Graph

Internal host context & DNS state

ThreatDB tracks which internal endpoints initiated contact, whether those endpoints carry managed EDR agents, and whether DNS resolved before connection.

  • Host mapping:Internal IP address inventory with has_agent status
  • DNS resolution:Flags raw IP connections where no prior DNS request occurred
  • Perimeter check:Identifies connections unlogged by edge firewall rules

Detection taxonomy

C2 beaconing

Identifies periodic outbound communication intervals and timing jitter characteristic of command-and-control agents.

Direct IP egress

Flags outbound connections made directly to raw IP addresses without preceding internal DNS resolution requests.

Firewall evasion

Catches traffic observed by passive network taps that bypassed standard perimeter firewall logging rules.

Phishing drop sites

Correlates newly registered IP targets and suspicious ASN origins linked to inbound email payloads.

Data exfiltration

Highlights single-host high-volume outbound byte transfers to unclassified foreign autonomous systems.

Scanning & brute force

Aggregates repeated connection attempts across multiple ports and endpoints into a single adversary profile.

Deterministic query replay & whitelist engine

Investigating an ongoing incident? Trigger historical replays over specific time windows to recreate finding state deterministically. Benign infrastructure can be whitelisted permanently to prevent recurring alert noise.

View whitelist in demo

Ecosystem & Stack

Standard infrastructure components with zero vendor lock-in

ThreatDB operates on standard open tooling with transparent data storage. Current production capabilities are listed alongside planned roadmap integrations.

Active native components

Production

Zeek network security monitor

Passive ingestion of conn.log and dns.log telemetry streams.

Elasticsearch & ESQL query engine

Distributed log indexing and scheduled piped aggregation queries.

SQLite indicator database & UI

Lightweight, self-contained indicator store with Flask web management console.

Firewall auto-block export

Structured indicator export endpoints for automated perimeter firewall rule creation.

Roadmap & planned integrations

Roadmap

Alerting webhooks (Pushover, Slack, Teams)

Direct notification channels when high-confidence C2 beaconing scores are detected.

AI-assisted triage investigations

Automated investigation summaries to filter known false positives and accelerate analyst review.

Multi-tenant REST API

External REST endpoints for multi-tenant indicator sync across distributed sensor networks.

Extended case management

Full finding lifecycle management (true positive, false positive, mitigation tracking).

Operational Context

The detection engine powering Probatio Managed SOC

ThreatDB was created by Probatio Cyber Defence GmbH to solve a recurring challenge in security operations: separating genuine adversary beaconing from routine outbound traffic without drowning analysts in alert fatigue.

As court-certified digital forensics and incident response experts, Probatio applies forensic rigor to indicator scoring. ThreatDB serves as the automated analysis core behind Probatio's Managed SOC service, turning raw daily connection logs into a curated review queue.

Forensic Engineering Standards

Operational capabilities

  • Austrian court-certified IT expert witness foundation
  • CISSP-certified architecture and operational processes
  • Forensically sound evidence chains for incident response
  • Deployable standalone or bundled with Probatio Managed SOC

Available as a self-hosted installation or a fully managed detection service.

Evaluation Process

Roll out ThreatDB in three practical steps

Test the platform on synthetic telemetry or run a pilot directly in your environment.

Step 01

Explore the live sandbox

Access our public demo environment with simulated network telemetry, realistic findings, and active indicator tables without registering.

Step 02

Technical walkthrough

Schedule a 30-minute review with a Probatio security engineer to inspect your existing Zeek sensor placement, log volumes, and firewall infrastructure.

Step 03

1-month evaluation pilot

Deploy ThreatDB alongside your Elasticsearch cluster. Evaluate real outbound traffic and indicator quality in your own network environment.

Ready to evaluate your outbound traffic?

Explore the live synthetic dashboard immediately or schedule a technical discussion with our engineering team.

Launch live demoSchedule a technical call