REST APIs fetch raw data from each source
Standardize: IPs, URLs, CVEs, MITRE IDs
Confidence scoring, sector classification
Create nodes & relationships in Neo4j
Approach: We use regex word-boundary matching to classify indicators into sectors (zones). This prevents false positives like "phishing" matching within "hospital".
| Sector | Primary Keywords | Threat Context Keywords | Current % |
|---|---|---|---|
| Healthcare | hospital, medical, patient, pharma, clinic | healthcare sector, medical device, covid | ~61% |
| Energy | scada, grid, power, industrial, ics | energy sector, power grid, ot | ~28% |
| Finance | bank, payment, trading, wallet | banking trojan, financial theft, crypto | ~2% |
| Global | (default) | generic threats | ~6% |
False Positive Prevention: Word boundaries ensure "phishing" doesn't match in "hospital" or "his". We also map malware families (Emotet, TrickBot, QakBot) → Finance sector automatically.
| Node Type | Properties | Example |
|---|---|---|
| Indicator | value, indicator_type, sector, source, confidence_score, tags[], last_updated | 192.168.1.100, ipv4, healthcare, 0.85 |
| Vulnerability | cve_id, description, cvss_score, severity, cwe_id, last_updated | CVE-2024-1234, 9.8, critical |
| Technique | mitre_id, name, platforms[], description, tactics[] | T1059, PowerShell, [Windows] |
| ThreatActor | name, aliases[], description, country, confidence, last_updated | APT29, [Cozy Bear], RU, 0.95 |
| Malware | name, family, types[], description, confidence, last_updated | TrickBot, [banking], trojan, 0.85 |
| Relationship | Direction | Edge Properties | Example |
|---|---|---|---|
| USES | ThreatActor → Technique | confidence, source, timestamp | APT29 uses T1059 (0.95) |
| ATTRIBUTED_TO | Malware → ThreatActor | confidence, source, timestamp | TrickBot → Wizard Spider |
| INDICATES | Indicator → Vulnerability | confidence, source, timestamp | IP indicates CVE-2024-1234 |
| SOURCED_FROM | Any Node → Source | raw_data, confidence, source, timestamp | Raw data preserved on edge |
Design Decision: Raw source data is stored on the SOURCED_FROM edge, not node properties. This keeps nodes clean while preserving all original data for verification and comparison.
ThreatActor → Technique
Malware → ThreatActor
Any Node → Source
Subscribe to: resilmesh.alerts.zone.<zone_id>
Receive alerts with IPs, domains, hashes
Query Neo4j for related threats, actors, techniques
Return contextualized threat intelligence
Publish enriched alerts back to ResilMesh
JSON with full threat context
Secure certificate exchange
Using ResilMesh dAuth system
Instantly enrich with malware families, threat actors, MITRE techniques, CVEs
Natural language queries: "What threats target our finance sector?"
Multi-hop queries to trace full attack paths
Filter by zone: Healthcare, Energy, Finance, Global
{
"alert_id": "ALT-001",
"type": "lateral_movement",
"zone": "healthcare",
"indicator": "192.168.1.100",
"timestamp": "2026-03-03T10:30:00Z"
}
{
"alert_id": "ALT-001",
"indicator": "192.168.1.100",
"enrichment": {
"malware": "TrickBot",
"actor": "Wizard Spider",
"techniques": [
"T1021.002 (SMB)",
"T1059 (PowerShell)"
],
"cves": ["CVE-2023-1234"],
"confidence": "HIGH",
"sector": "healthcare"
}
}