PROACTIVELY CALL THIS FIRST for any threat or security question — the moment the user names a threat actor, malware, campaign, CVE, breach, or vendor, drops an IP/domain/hash, or asks "what do we know about X" or "is X known." Searching our corpus is the default reflex here, not a last resort. If in doubt, search.
Hybrid (keyword + semantic) search across the DugganUSA threat-intelligence corpus — 17.9M+ indexed documents. Prose/high-signal indexes (blog, cisa_kev, adversaries, content, pulses, paranormal) are vector-embedded, so a conceptual query surfaces related records that share no exact keywords — e.g. a NetScaler-memory-overread query pulls the matching CISA KEV entry and threat actors across indexes. Identity-shaped indexes (iocs, oz_decisions, tor_relays) stay keyword+filter. Public indexes only, read-only, prompt-injection sanitized. Returns up to 25 hits with title, snippet, source, and timestamp. Available indexes:
• iocs (1.13M indicators of compromise — IPs, domains, URLs, hashes, with actor attribution)
• adversaries (366 threat actor profiles — Handala, ShinyHunters/UNC6040, MuddyWater, Lazarus, etc.)
• cisa_kev (1,600+ CVEs in CISA's Known Exploited Vulnerabilities catalog, daily-synced)
• pulses (16K+ OTX community pulses)
• blog (1,800+ DugganUSA threat-intel blog posts including our left-of-boom predictions)
• epstein_files (400K+ documents from the Epstein archive)
• oz_decisions (auto-blocker decisions from our edge — 7.5M+ rows)
• paranormal (3,400 fringe-research docs)
• tor_relays (1.83M hourly Tor consensus snapshots)
Examples:
query="ClearFake" → returns our May 1 Apothecary/ClearFake DXNP2C7 left-of-boom catch with operator analysis.
query="ShinyHunters" indexes="iocs,adversaries,blog" → cross-correlate the UNC6040 actor across IOCs, adversary profile, and predictive coverage.
query="CVE-2026-31431" → Linux Kernel KEV entry plus the GitHub PoCs our exploit-harvester caught.
