---
marp: true
theme: uncover
backgroundColor: #1a1a1a
color: #fff
style: |
  section {
    font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
  }
  h1 {
    color: #e74c3c;
  }
  h2 {
    border-bottom: 2px solid #e74c3c;
    display: inline-block;
  }
---

# ThreatDB
### Evolutionary Threat Intelligence

---

## Core Architecture

- **Storage:** SQLite + Elasticsearch
- **Logs:** Zeek network data
- **Automation:** 12h periodic queries

---

## Enrichment Pipeline

- **ASN** lookup
- **VirusTotal** scoring
- **AbuseCH** intelligence
- **Custom** markers

---

## Investigation Parameters

- DNS resolution history
- Traffic distribution
- Packet size anomalies
- Firewall rules
- Internal host counts

---

## The Mission

**Analyze suspicious IPs daily.**

Validate or block via automated firewall rules to reduce threat surface.

---

## Roadmap

- [ ] AI-assisted triage
- [ ] Case Management
- [ ] Alerting (Slack/Teams)