Kraken 1.0‑eval «Hadal» — now in early access
A modular, actor-centric Cyber Threat Intelligence platform that continuously collects, models and analyzes adversary infrastructure, with integrated malware analysis through Mantis, all in one system.
Data is scattered across dozens of tools, feeds and platforms. Threat actors, however, operate as systems. Kraken closes the gap between the noise you collect and the picture you actually need.
Static IOC lists decay within days. Kraken tracks infrastructure as a living system: from isolated indicators to continuous intelligence.
Automated graph expansion turns a single lead into a structured, attributed actor footprint.
No mockups, no waitlist features. Everything here is implemented in the current release and ready to use.
A directed, typed multigraph of threat entities and labeled links, with attribution to actors, campaigns and operations.
Every claim is tied to concrete evidence. “Why does this entity exist?” is always answerable, full audit trail included.
Tracking definitions expand into concrete tasks, with schedules, backoff, per-entity policies and reusable templates.
Module results flow through a Redis stream, import profiles and import rules into the graph, structured and traceable.
Numeric scores (0–100) per entity, tracked over time, with factors for source quality, recency and infrastructure overlap.
A visual, node-based editor for event-driven workflows. Trigger → conditions → actions, run automatically on the event stream.
26 IIM techniques (hosting, resolution, routing, gating…) describe how an actor builds infrastructure, not just which IPs.
Custom Python modules without touching the core. The Foundry builds each version into a container image, run in isolation by schedule or event.
A managed HTTP/SOCKS pool with continuous health-checks and scoring, collection never originates from Kraken’s own IP.
Rule-driven delivery over email and webhooks on top of the event system, every delivery audited, rules reloadable without restart.
Domain events (entity.created, actor.created…) on a Redis stream, the shared backbone for automations and notifications.
Background cleanup keeps the system lean: prunes heartbeats, old tasks, facts and events on a schedule, no manual upkeep.
Not a bolt-on tool: Mantis runs as a first-class service inside Kraken, sharing the same databases, the same authentication and the same event system. From sample upload to attribution in one continuous flow.
From raw collection to operational analysis: modeling, pipelines, intelligence and extensibility in one platform.
Kraken runs as a distributed multi-service system with clean separation of collection, scheduling, processing and presentation.
From fragmented data to structured intelligence. Where signals form patterns. Where data becomes intelligence. Where adversary activity becomes visible.
Kraken 1.0‑eval «Hadal» is opening to the first registrants who genuinely want to put the platform to work. Kraken is not a public intelligence platform. Access is restricted and granted through a manual review process. Full feature set, a direct line to the team, and your feedback shapes the next release.