threat_weaver

Reducing time and uncertainty in contextualizing new threats (alerts, CTI noise, group communications, new CVEs) is a critical need for SOC and Threat Intelligence: without context, responses remain slow, fragmented and heavily dependent on manual analysis.

The Threat Waver system transforms raw threat intelligence signals (APT, TTP, CVE / CWE / CPE, target sectors, events) into an operational context to decide what to do first.

It reduces triage times: starting from a new threat (e.g. a group announces a sector specific attack), it quickly reconstructs the threat actor's ecosystem: typical targets, recurring techniques, tools, campaigns and preferred vulnerabilities.

It enables "similarity recall": when a new CVE emerges, it identifies similar vulnerabilities that have already been observed and shows who has exploited them and with which TTPs, helping to quickly understand how it could be used in an attack scenario.

Improve risk governance: support business owners and SOCs with views by industry/asset (CPE/vendor/product) and with structured evidence useful for reporting and audits.

The solution is based on a knowledge graph that connects APT, TTP, CVE/CWE/CPE, events and campaigns, allowing navigation by relationships and timelines. A correlation and technical-semantic similarity engine automatically enriches the links (e.g. "similar CVEs", "associated TTPs", "affected sectors"), offering a unified and easily searchable view to accelerate triage, investigation and operational coordination.

In addition, the user will be able to query the knowledge graph in natural language and deepen the context with the support of an agent able to understand and reason about the knowledge represented in the graph.