Building Threatweave

A few months ago I was triaging a suspicious IP with VirusTotal, AbuseIPDB, Shodan, and OTX open in four tabs, reconciling the results by hand for something like the hundredth time. Threatweave is what came out of that.

What it does

Threatweave is a self-hosted threat intelligence platform that fans a single query out to 12+ providers, including VirusTotal, AbuseIPDB, AlienVault OTX, Shodan, URLhaus, MalwareBazaar, ThreatFox, Mnemonic PDNS, Google Safe Browsing, Triage, and URLScan. It takes IPs, domains, file hashes, and URLs, and normalizes everything that comes back into a unified risk score instead of leaving six different rating systems for you to reconcile by eye.

Batch mode accepts up to 50 indicators at once and streams results as they land, which is the mode that matters when you are working an incident with a pile of IOCs rather than looking up a single address.

Architecture

The design constraint was something I could run in a home lab without it turning into a maintenance burden.

• Backend: Go 1.24 with the Chi router, deployed as a single binary
• Frontend: Svelte, 115+ components across the main dashboard, admin panel, and embeddable widget
• Storage: PostgreSQL 16 for persistence, Redis 7 for caching and session management
• Deployment: Docker Compose with Caddy handling automatic HTTPS through Let’s Encrypt

Provider responses are cached with configurable TTLs so repeated lookups return immediately, and per-provider rate limiting keeps duplicate queries from burning API quota or hammering upstream services.

What I use day to day

Pivoting across indicators by shared threat actor, malware family, ASN, or passive DNS data surfaces relationships that are not visible when you are bouncing between separate tools, and the correlation engine that does it has turned into the part I reach for most. Context that used to take twenty minutes to assemble by hand comes back in one view.

The watchlist tracks field-level changes between lookups, so a shifted risk score, a newly opened port, or modified WHOIS data comes up on its own. I have caught a couple of indicators moving from suspicious to confirmed malicious this way before they showed up in any feed.

Intelligence feeds pull automatically from 16+ sources including Hacker News, Bleeping Computer, CISA KEV, NIST NVD, Krebs on Security, and Cisco Talos, with extracted IOCs enriched in the background so anything that appears in a morning briefing already has data behind it.

All of it is exposed over 50+ REST endpoints, which keeps the work of wiring it into a SOAR platform or custom tooling short.

In progress

The correlation graph visualization needs work and I want more pivot paths through the data. Detection coverage across providers is something I am tracking more carefully now and want surfaced in the UI rather than buried.

The embeddable widget at /widget is next. Running quick lookups from a browser extension or an internal tool without loading the full dashboard is what I want out of it day to day.

Further reading

Threat Intelligence Platforms: A Practitioner’s Guide (SANS Reading Room). Covers where a TIP sits in a SOC workflow and what to look at when evaluating one.

Building a Home Lab for Threat Intelligence (Bleeping Computer). Walks through standing up self-hosted security tooling without enterprise infrastructure behind it.

MITRE ATT&CK for Threat Intelligence (MITRE ATT&CK, updated 2024). Worth reading if you want to connect IOC enrichment to adversary behavior, which is where the ATT&CK integration in Threatweave is headed.